Network and segmentation
Segmentation limits how far an intruder can travel, but it stalls when nobody can say what a workload is. Labels that describe applications, environments and roles come first, and the rules that follow from them are much simpler to write and to test.
New to this? The simple version
Field notes
- DNSSEC: why it exists, who uses it and what it has broken
DNSSEC lets a resolver check that a DNS answer really came from the owner of the name. It was built to stop forged answers, it is switched on far more by resolvers than by domain owners, and when it fails it takes whole domains, and once a whole country's zone, offline.
- Email was built to trust everyone: TLS, SPF, DKIM and DMARC, and what each one breaks
Email still runs on a 1980s protocol that lets any server claim to be anyone and send in the clear. Opportunistic TLS, SPF, DKIM and DMARC were added on top, one problem at a time. Each fixes something real, each breaks something else, and none of them stops a lookalike domain.
- IP address or identity: what should actually let someone in?
An IP allowlist says where a request comes from. Identity says who or what is asking. Both still have a place, on the internet and inside the network, but each only works when certain things are in place, and each fails in its own way.
- Blast radius belongs in the board pack
Boards are told how many vulnerabilities were patched and how many people did the training. The question they actually need answered is how far one intruder could get. Blast radius can be measured, tested and reported in a line, and it belongs in the board pack.
- Labels before rules: why microsegmentation projects stall
Microsegmentation projects stall because nobody can say what each workload is. Label the estate first, by application, environment and role, and the rules almost write themselves.
Tools
- LabelSim
Simulate Illumio-style labels and see the blast radius before touching a real policy.
Personal work and my own view, not my employer's. Sources are public.