- [Instructor] Another dilemma is
the machine-to-machine communication
between different systems and applications.
How do you also segment and protect that
in an effective manner?
In today's virtualized and containerized environments,
traffic between applications may never leave
a physical device or server.
This is illustrated in the diagram below.
This is why micro-segmentation is so popular nowadays.
A solution of the past is to include virtual firewalls
between VMs as shown in the diagram below.
Machine-to-machine
or application-to-application communication also needs
to be segmented within an organization.
For instance, let's take a look at this figure.
Does your active directory servers need to communicate
to Network Time Protocol Servers?
What is their relationship in data interaction?
NTP implementation send and receive timestamps
using UDP port 123.
However, NTP Servers can also use
broadcasting or multicasting
where clients passively listen to time updates
after an initial roundtrip calibrating exchange.
Which of the two need to be allowed or protected?
Of course, this is a simple example.
And in this case, UDP port 123 can be used.
However, what if an attacker can tunnel traffic over NTP
and exfiltrate information from the organization?
All these questions need to be answered
when you are creating your segmentation strategy.
Furthermore, do you know what applications are running
in your environment?
What applications are talking to the cloud?
Which are hosted in the cloud?
How do you do application enumeration and mapping?
However, one of the most elegant solutions
of micro-segmentations is the one provided
by Cisco Application Centric Infrastructure, or ACI.