Issue link: https://insights.oneneck.com/i/1458399
CHAPTER 1 The Evolution of the Data Center 13 These materials are © 2020 John Wiley & Sons, Inc. Any dissemination, distribution, or unauthorized use is strictly prohibited. (continued) • A strategy that uses whitelisting for positive security enforce- ment and helps you define trust zones to move toward a Zero Trust architecture. Start with tiered applications and proceed from that model with regard to Zero Trust micro-segmentation. • Architecture that consistently protects traffic flows initiated by users or from bare metal servers, virtual machines, and contain- ers hosted in on-premises data centers, private clouds, public clouds, or even branches and campuses. 2. Work with stakeholders in IT/Support and Security as well as groups that require data center access, such as Engineering and Legal, to develop an access strategy. You'll want to: • Identify users who need access — and the assets they need to access — to define efficient security policy rules by user group. • Enforce granular access by implementing segmentation to create trust zones and minimize the opportunities of attack across north-south and east-west traffic. 3. Assess your data center to understand its current state so you can create a plan to reach your desired future state. You should: • Inventory the physical as well as virtual environment and assets, and determine which assets you should protect first. • Work with application, network and enterprise architects, as well as business stakeholders, to learn about typical baseline traffic loads and patterns so you understand normal work behavior. 4. Create a data center segmentation strategy to help reduce risk and business impact by preventing hackers from stealing data as well as stopping malware that gains a foothold in your data center from infecting other systems. Use firewalls based on flexible form factors to design a granular segmentation strategy for physical and virtual networks to pro- vide visibility into your data center traffic everywhere — at the perimeter, on the network, and on the host.