Enforce security rules in front of every server

In traditional network security, the firewall sits at the edge of the network and filters traffic coming in from outside. Yet many attacks start inside: a computer whose user clicks a phishing email becomes the attacker’s first foothold. On a traditional network, servers are open to each other from that point on, and the attacker can move sideways.

In a software-defined network, the rule is written in front of each server rather than at the edge of the network. An example rule set:

• The accounting application reaches its database only on the database port.
• No machine other than the application server can reach the database.
• Remote desktop and file sharing between servers are open only from the management network.

With this rule set, a compromised computer can reach only a few ports. Lateral movement hits a rule at the first step and is logged. Because the rule is enforced in the virtualization layer, it moves with the server to whichever physical host it goes to. Matching network device configuration to the server inventory is no longer needed.