Strategic Divisions: Implementing Mission/Organization-Based Macro Segmentation (Zero Trust Activity 5.3.2)

We’ve established the importance of segmenting our networks to limit lateral movement, from broad network plane separation (5.2.3) to datacenter macro-segmentation based on service tiers (5.3.1). Now, Zero Trust Activity 5.3.2: B/C/P/S Macro segmentation takes a similar approach to macro-segmentation as 5.3.1 but organizes the network’s logical divisions around the operational and mission fabric of the organization’s mission.

“B/C/P/S” stands for Base/Camp/Post/Station, and in the context of this Zero Trust activity, it signifies implementing macro-segmentation that aligns with the distinct operational or mission scopes associated with these installations or similar logical groupings. This means we’re designing logical network zones that limit lateral movement not just between physical sites, but between the specific domains of a Base, Camp, Post, or Station’s functions. This could translate to separating networks based on Business Units, specific Projects, distinct Mission responsibilities, or Communities of Interest that are inherent to these installations.

Similar to 5.3.1, proxy and/or enforcement checks are integrated with the SDN or alternative networking approach solution(s) based on device attributes and behavior, ensuring dynamic, context-aware policy enforcement at these crucial logical boundaries.

This approach aligns network security directly with the enterprise’s operational and mission structure. It ensures that an attacker gaining a foothold within one logical B/C/P/S domain cannot easily pivot to the systems of another distinct mission or project without explicit Zero Trust re-verification.

The outcomes for Activity 5.3.2 are consistent with previous macro-segmentation efforts, emphasizing context-aware enforcement and adding an analytical component:

1. Establish proxy/enforcement checks of attributes (device, location, data), access and flow (client, tenant, traffic patterns), and Component principles (asset life cycle, compliance, policy).
2. Analyze activities of application specific security stacks for firewall configuration and access policies.

The ultimate end state highlights a robust and efficient network security posture: SDN or alternative networking approach solutions incorporate proxy and enforcement checks based on device attributes and behavior, ensuring robust security. Application delivery control proxies, SIEM logging, UAM, and authentication decision points are integrated and operational. Segmentation gateways are deployed to enhance network security and efficiency. This signifies comprehensive control over broad, mission-aligned service interactions.

Solutions for Achieving B/C/P/S Macro Segmentation

Implementing Activity 5.3.2 requires a focus on defining logical network zones based on organizational constructs and enforcing them using programmable network security solutions:

1. Defining Mission/Organization-Based Logical Network Zones:
   1. Process: Collaborate with business units, mission owners, and project leads to define clear boundaries for logical network zones based on their B/C/P/S. Identify which users, devices, applications, and data belong to which mission or organizational segment. This leverages the “Communities of Interest” identified in Activity 5.1.1.
   2. Mapping Attributes: Ensure that users and devices are tagged with relevant organizational attributes (e.g., “Business Unit: Finance,” “Project: Quantum_Leap”) within your Identity Provider (IdP) and Device Management solutions. These attributes will drive policy.
2. Implementing Network Segmentation Technologies (Managed Programmatically):
   1. Utilize your SDN or alternative networking approach to programmatically create and manage logical boundaries between these B/C/P/S-aligned segments. This often involves high-capacity Next-Generation Firewalls (NGFWs) or routers with advanced segmentation capabilities (e.g., VRFs) deployed at critical network demarcation points, or software-defined overlays.
   2. The SDN controller can dynamically configure VLANs, VRFs, and firewall rules to enforce these logical separations, even if the physical network is shared.
3. Integrating Proxy and/or Enforcement Checks Based on Attributes and Behavior:
   1. Policy Enforcement Points: Deploy and configure enforcement points (such as Application Delivery Controllers (ADCs), segmentation gateways, or ZTNA solutions) at the boundaries of these logical zones.
   2. Attribute and Behavior-Driven Decisions: These enforcement points are integrated with your IdP, UEM, EDR, and UEBA tools to make access decisions based on the user’s organizational attributes, the device’s managed status and compliance, its location, and its real-time behavioral risk score. This ensures dynamic, context-aware enforcement at macro-segment boundaries.
4. Analyzing Application-Specific Security Stacks:
   1. Conduct in-depth analysis of existing application-specific firewall configurations and access policies. The goal is to identify and consolidate these into the new, centralized, mission/organization-based macro-segmentation framework, minimizing standalone, potentially inconsistent, security configurations.
5. Establishing Comprehensive Logging and Monitoring:
   1. Ensure all enforcement points generate detailed logs of access and policy decisions at these logical boundaries. Feed these logs into your SIEM for centralized monitoring, correlation, and alerting. Integrate UAM to monitor user behavior across these new segments.

How Zscaler Can Be Leveraged to Deliver Desired Outcomes and End State:

Zscaler’s cloud-native Zero Trust Exchange is exceptionally well-suited to implement B/C/P/S-based macro-segmentation when interpreted as logical, mission-aligned separation, as it enforces policies based on user identity and application context rather than solely relying on underlying physical network constructs.

• Logical Network Zones based on B/C/P/S Operational Context: Zscaler excels at defining and enforcing “logical network zones” that directly align with the operational or mission scope of a Base, Camp, Post, or Station. Policies can be created in Zscaler that state, for example, “Users belonging to the ‘Logistics Command’ (from IdP attributes) on ‘compliant’ devices can access applications tagged ‘Logistics_Systems_Central.'” This allows you to define policies that logically segment access based on an organizational/mission role associated with a B/C/P/S, spanning your entire distributed environment (on-prem, cloud, remote users) without complex physical network re-architectures.
• Proxy and Enforcement Checks based on Device Attributes and Behavior: Zscaler’s platform acts as the intelligent proxy and enforcement point. It inspects all traffic inline and enforces policies based on:
  • User Attributes: Consumes user attributes (e.g., assigned business unit, project role) from your IdP (like Okta) that reflect their B/C/P/S operational context.
  • Device Attributes: Integrates with UEM/EDR solutions (like Trellix) to pull device posture, compliance, and managed status.
  • Behavioral Risk: Consumes user and device risk scores (from UEBA/SIEM, like Elastic) to inform policy decisions, ensuring robust security.
  • This directly fulfills the outcome of establishing “proxy/enforcement checks of attributes (device, location, data), access and flow,” leveraging device attributes and behavior for robust security.
• Limiting Lateral Movement with Application-Aware Segmentation: By making applications “dark” to users or devices outside their authorized B/C/P/S-aligned logical segment and enforcing per-application access, Zscaler inherently limits lateral movement between these mission domains. An attacker compromising a device within the “Training Unit” segment won’t see or be able to access applications logically belonging to the “Cyber Operations Center” segment unless explicitly authorized by policy brokered through Zscaler.
• Centralized Policy Management: Zscaler’s cloud-based policy management simplifies defining and enforcing these mission/organization-based macro-segmentation policies across your entire distributed enterprise from a single console, reducing the complexity often associated with managing thousands of firewall rules across disparate physical locations or logical domains.
• Contributing to End State Integration: Zscaler’s platform is designed to integrate with ADCs, feed comprehensive logs into SIEM, incorporate authentication decision points, and serve as a logical segmentation gateway, directly contributing to the unified and robust security posture outlined in the activity’s end state.

Key Items to Consider:

• Clear Organizational Boundaries: Precisely define your B/C/P/S boundaries and ensure these are reflected in your identity attributes (e.g., user groups, department tags in your IdP).
• Attribute Governance: Maintain strict governance over identity attributes used for policy enforcement to ensure accuracy and consistency.
• Consolidating Application Security: The outcome of analyzing application-specific firewall configurations is key to migrating these into the unified macro-segmentation policy, reducing fragmentation.
• User and Application Mapping: Accurately map users, devices, and applications to their respective B/C/P/S segments to define correct access policies.
• Performance and Scalability: Ensure your chosen enforcement solution (like Zscaler) can handle the traffic volume and user concurrency across your large, distributed enterprise.

For the Technical Buyer

Activity 5.3.2 is about taking your Zero Trust macro-segmentation to a more business-aligned level, dividing your network into logical zones based on missions, business units, or projects. For technical buyers, this means leveraging your programmable network infrastructure or cloud-native platforms like Zscaler to enforce policies at these boundaries based on granular device attributes and behavior. Zscaler’s ability to define and enforce access based on user groups and application identities across its Zero Trust Exchange is particularly well-suited for this mission/organization-based segmentation. This activity ensures that an attacker’s lateral movement is severely restricted, not just between application tiers, but specifically between your critical organizational functions.

Pillar: Network and Environment

Capability: 5.3 Macro Segmentation

Activity: 5.3.2 Base/Camp/Post/Station (B/C/P/S) Macro-Segmentation

Phase: Target Level

Predecessor(s):

• 5.2.3 Segment Flows into Control, Management, and Data Planes

Successor(s): None