Semi-automatic communication network microsegmentation
A technique for microsegmentation includes receiving information related to hosts and applications operating in a network where the information was obtained based on a survey of the network; identifying a plurality of microsegments utilizing the information, each microsegment includes a set of hosts similar to one another; for each of the plurality of microsegments, identifying security policies that control access to hosts in each microsegment; and providing the plurality of microsegments and corresponding security policies for approval thereof.
1. A method comprising steps of:
receiving information related to hosts and applications operating in a network where the information was obtained based on a survey of the network;
identifying a plurality of microsegments utilizing the information, each microsegment includes a set of hosts similar to one another;
for each of the plurality of microsegments, identifying security policies that control access to hosts in each microsegment; and
providing the plurality of microsegments and corresponding security policies for approval thereof.
2. The method of claim 1 , wherein the steps include
responsive to the approval, applying the plurality of microsegments and the corresponding security policies.
3. The method of claim 2 , wherein the approval is on a per microsegment basis.
4. The method of claim 1 , wherein the steps include
periodically repeating the receiving and the identifying steps to any of update existing microsegments and create new microsegments.
5. The method of claim 1 , wherein the set of hosts are similar to one another based on any of
their communication with one another,
communication with another set of hosts, and
software installed thereon.
6. The method of claim 1 , wherein the security policies include any of allowing or disallowing inbound connections and/or outbound connections.
7. The method of claim 6 , wherein the security policies are applied on a per application basis on each host.
8. The method of claim 1 , wherein the providing includes displaying an output including listing names and/or Internet Protocol addresses of the hosts in each of the plurality of microsegments.
9. A non-transitory computer-readable medium storing computer program instructions that are executed by at least one computer processor to perform steps of:
receiving information related to hosts and applications operating in a network where the information was obtained based on a survey of the network;
identifying a plurality of microsegments utilizing the information, each microsegment includes a set of hosts similar to one another;
for each of the plurality of microsegments, identifying security policies that control access to hosts in each microsegment; and
providing the plurality of microsegments and corresponding security policies for approval thereof.
10. The non-transitory computer-readable medium of claim 9 , wherein the steps include
responsive to the approval, applying the plurality of microsegments and the corresponding security policies.
11. The non-transitory computer-readable medium of claim 10 , wherein the approval is on a per microsegment basis.
12. The non-transitory computer-readable medium of claim 9 , wherein the steps include
periodically repeating the receiving and the identifying steps to any of update existing microsegments and create new microsegments.
13. The non-transitory computer-readable medium of claim 9 , wherein the set of hosts are similar to one another based on any of
their communication with one another,
communication with another set of hosts, and
software installed thereon.
14. The non-transitory computer-readable medium of claim 9 , wherein the security policies include any of allowing or disallowing inbound connections and/or outbound connections.
15. The non-transitory computer-readable medium of claim 14 , wherein the security policies are applied on a per application basis on each host.
16. The non-transitory computer-readable medium of claim 9 , wherein the providing includes displaying an output including listing names and/or Internet Protocol addresses of the hosts in each of the plurality of microsegments.
17. A system comprising at least one computer processor executing computer program instructions stored on at least one non-transitory computer-readable medium to perform steps of:
receiving information related to hosts and applications operating in a network where the information was obtained based on a survey of the network;
identifying a plurality of microsegments utilizing the information, each microsegment includes a set of hosts similar to one another;
for each of the plurality of microsegments, identifying security policies that control access to hosts in each microsegment; and
providing the plurality of microsegments and corresponding security policies for approval thereof.
18. The system of claim 17 , wherein the steps include
responsive to the approval, applying the plurality of microsegments and the corresponding security policies.
19. The system of claim 18 , wherein the approval is on a per microsegment basis.
20. The system of claim 17 , wherein the steps include
periodically repeating the receiving and the identifying steps to any of update existing microsegments and create new microsegments.