Akamai has published The State of Segmentation 2023 report, and it has thrown up some surprising numbers. For example, across those surveyed, ransomware attacks are now running at twice the level of two years ago. The two most attacked nations are the US (115) and Germany (110).
Steve Winterfeld, Advisory CISO at Akamai, said, “The cybersecurity landscape is always evolving and shifting based on the latest threat methodologies developed by cybercriminals. Whether it’s defending against ransomware, new zero days, or sophisticated phishing attacks, it’s vital that organizations reevaluate their risks to protect their critical assets.
“One of the key ways to do this is with a Zero Trust architecture. That means utilizing a combination of Zero Trust Network Access and microsegmentation integrated as part of a clear security strategy supported by access to staff and partners with necessary skills.”
The need for segmentation
The key focus of the report was how segmentation was helping to reduce attacks. The results appear to suggest that those companies that do invest in a coherent and planned segmentation strategy, are seeing results. According to the report, “Segmentation proved to have a transformative effect on defense for those who had segmented most of their critical assets, enabling them to mitigate and contain ransomware 11 hours faster than those with only one asset segmented.”
What is interesting is that countries with very mature IT infrastructure are not as good as others when it comes to segmentation. The report does not go into details as to why this is, and that is disappointing. There are certainly some lessons to be learned. For example, is the complexity of mature IT infrastructures a problem with segmentation? What is needed to increase the use of segmentation?
Of the 10 countries where the research was carried out, India (58%) was the best at segmenting more than two IT assets. Mexico (48%) and Japan (32%) were in second and third place. Surprisingly, the UK (28%) was in sixth place while the US (21%) was in 9th place.
What is important about those numbers is that 93% of respondents believe segmentation is key to thwarting damaging attacks. It raises the question, therefore, as to what is inhibiting segmentation?
The report also looks at the role of segmentation in zero-trust frameworks. It claims that it plays a major part in making them successful, yet it was only the third-most common reason for deployment.
Why microsegmentation is even better
If segmentation is good, microsegmentation is better, at least, according to the report. It makes it easier to protect workloads at a granular level. Another benefit should be making it harder for malware to traverse the network.
Interestingly, 89% of respondents say it is a high priority while 34% say it is their top priority. With only two countries having a deployment rate above 34%, it begs the question of how realistic are those making it a high or top priority? One thing that might cause increased interest in using it, is adoption by peers.
According to the report, “97% of IT security teams and decision-makers report that it has been adopted by at least a minority of their industry. This number drops to 80% for those in the public sector (excluding healthcare) — a difference that may be attributable to tighter budgets and legacy infrastructure posing greater obstacles to deploying microsegmentation’s workload-level protection.”
The report’s authors also believe that public sector organisations should be giving microsegmentation a closer look. The reason for this is, “systems in this sector are not necessarily designed to interact with one another, they lack interoperability, which increases both the likelihood of human error and likelihood of a successful cyberattack.”
Public sector organisations seem to agree. Only 15% say they have no segmentation despite 93% recognising its importance. Interestingly, compliance requirements (52%) are seen as the biggest obstacle.
Enterprise Times: What does this mean?
Segmentation has been a security topic for years, yet uptake has been slow and limited. There are many reasons, but perhaps the biggest, historically, has been a lack of a coherent enterprise-wide architecture to know how best to segment. The cause is simple, enterprise networks have evolved by need, rather than be planned. Once in place, nobody wants to restructure or redesign to prevent an impact on the business.
This report shows that there are clear benefits to segmentation and microsegmentation. It also shows that there is an acceptance that there are significant benefits to doing this. However, success is being hampered by a number of factors, including lack of skills (39%), increased performance bottlenecks (39%), compliance requirements (39%) and complexity (36%).
The question is, will concerns over security and the need to deploy zero-trust, drive a solution to the problem?
