How environment separation improves data security [Part 1]

The World Economic Forum Global Risks Report 2020 has listed cyberattacks and data fraud or theft, within the list of top 10 long-term risks. We live in a data-driven society, and enterprises are taking a hard stance on ensuring data privacy. As CIOs of enterprises that are built on customer trust, data privacy and security are the two key elements that should matter the most.

Data loss? Intentional or inadvertent?

Not all data breaches/losses happen intentionally, by bad actors within or outside the organization. Some of them happen inadvertently, especially when production data gets mixed up in development environments, or when developers have access to data on the production environment. It could be because one of your junior administrators/developers had access to production data and deleted it by mistake (a very costly mistake!). You may recall the 2012 Amazon incident, when one of their developers inadvertently deleted load balancer data on the production environment? In this case, the error was noticed, but the customers started experiencing performance issues. What if you never noticed the data loss/breach due to environment contamination? At this point, it doesn’t matter whether it was intentional or not.

Environment separation

The logical approach to prevent data breach/loss due to production data cross-talk with other test and development segments is to isolate each of these environments. Creating secure, zero-trust networks for your east-west traffic. Well, how easy is this? Remember, the production environment’s security policies will be designed to be different from that of the test and development ones. Also remember, your enterprise might be a dynamic application environment with distributed applications.

Conventional environment separation challenges

Creating subnets is one of the several methods to segment and isolate environments. Irrespective of whether you have a couple of environments or several hundred environments, the time and effort that goes into creating VLANs and defining the ACLs, is humongous. Even after spending several hours and sweating it out, there’s no guarantee that:

1. The environments will have the correct set of security policies, and
2. The environments are free from configuration errors

The same applies to environment separation using internal firewalls. In addition to being capital intensive, your IT staff will have to deal with configuring thousands of firewall rules. Also, you don’t want your east-west traffic to suffer from performance degradation, do you? Why invest, and create additional chokepoints? Change management For every creation of a segment, or movement of a resource or an application across segments in your data center, your IT team must be on the same page with several stakeholders. Though this is essential for maintaining the security posture of your data center, this adds to the overall operational complexity in executing environment separation. In short, doing environment separation using conventional techniques has some serious drawback:

• Misconfigurations
• Unsecured subnets
• Time-consuming cross-segment change management
• Compromised security posture of the data center

How do you evade all these and improve your security posture with secure environment separation? Get answers in the second part of our environment separation blog series.