lgkm.org
Microsegmentation · risk reduction

Shrinking the blast radius

When one workload is compromised, the attacker can reach whatever the network lets it reach. Every boundary you enforce draws a tighter line around it. Put up the cheap, wide boundaries first and the precise ones last, and most of the risk is gone long before the hard work starts.

Six boundaries, coarse to fine

Coarse · a few deny rules · no application knowledgeFine · many allow rules · needs traffic data

    Each box is one boundary. Its area is the exposure left inside it: reachable workloads weighted 1 on any port, 0.5 with the risky ports shut and 0.1 on named services only.

    The same thing, workload by workload

    A 41-workload hybrid estate, grouped by Location, Environment and Application. Solid outlines are the boundaries enforced so far. Tap any workload to compromise it instead.

    Risk against effort

    Exposure left after each stage, against the rules it took to get there. The first boundaries are a handful of deny rules each; the allow-lists are where the hours go.

    The approach in three rules

    1 · Deny wide, then allow narrow

    Fence first, coarse to fine

    Risky-port, Environment and Location boundaries are deny rules over a few labels. They need no application knowledge, run safely in Selective enforcement, and remove most of the reach.

    2 · Precision is earned

    Allow-lists last, one app at a time

    Application and Role rules need the dependency map from the visibility stage. Each one is real work with an application owner, so they come after the cheap wins, in order of business risk.

    3 · Labels are the control

    Get the labels right

    Every rule is written against labels, never IP addresses. A workload with the wrong Environment or Location label lands on the wrong side of a fence. See how labelling works →