Three critical needs in data center security
Visibility
When securing the data center, there needs to be visibility of users, devices, networks, applications, workloads, and processes. Visibility makes it easier to detect performance bottlenecks, which informs capacity planning. It can speed attack-detection and make it easier to identify malicious insiders who are attempting to steal sensitive data or disrupt operations.
Visibility also improves post-incident response times and forensics, which can uncover the extent to which critical systems were breached and determine what information was stolen.
Segmentation
Segmentation reduces the scope of an attack by limiting its ability to spread through the data center from one resource to another. For servers on delayed patch cycles, segmentation is an important tool. It reduces the possibility that a vulnerability will be exploited before adequate patch qualification and deployment into production is complete. For legacy systems, segmentation is critical to protect resources that don't receive maintenance releases or patch updates.
Many attacks focus on having direct access to a system to compromise it through application vulnerabilities, unsecured ports, or denial-of-service (DoS) attacks. DoS attacks crash the system and allow the attacker to gain admin control and install malicious code to continue the breach. If the hacker can't gain access to a high-value asset in the data center, many attacks can be prevented rather than continue until detection or system compromise.
For some industries, like utilities, advanced persistent threats are a way of life. It is almost impossible to defend against this type of attack 100 percent of the time, but segmentation is a valuable tool to slow down the hacker and give security teams time to identify the problem, limit exposure, and respond to the attack.
Threat protection
All data centers need to protect their applications and data from an increasing number of sophisticated threats and global attacks. All organizations are under threat of attack, and many have been breached but are unaware of it.
Protecting the modern data center is a challenge for security teams. Workloads are constantly moving across physical data centers and multicloud environments. That's why the underlying security policies must dynamically change to help enable real-time policy enforcement and security orchestration that follows the workload everywhere. In a data center with multiple customers, such as a public cloud environment, one customer may attempt to compromise another's server to steal proprietary information or tamper with records.
Mobile and web applications can strengthen customer loyalty, but they increase the attack surface and create another avenue for exploitation. Employees may unwittingly compromise the business and contribute to a data breach. Hackers often begin by gaining access to an employee's authentication credentials. They do this by infecting an endpoint device with malware or using phishing or other social engineering techniques to trick users into supplying their credentials. The hacker can now gain "authorized" access to a server or servers within the data center, access more user accounts, and continue toward the target server where the data theft occurs.
You can mitigate the business disruption and impact from a breach by deploying comprehensive, integrated security products that work together in an automated process. This streamlines threat protection, detection, and mitigation.
