http://localhost:8080/illumio_basic/3.harden/index.html Lateral movement works when security teams focus on keeping people out via perimter security without thinking about what happens should someone get in. Network segmentation is a valuable tool for protecting against the inevitable truth that perimeter security will eventually be bypassed and is a crucial part of a defense-in-depth strategy. We will use Illumio to define a virtual network segment and place our server inside of this segment. This will enable our server to access the resources it needs while also restricting access to unnecessary components of our internal network. Hugo en-us Tue, 05 May 2020 13:15:09 -0400 http://localhost:8080/illumio_basic/3.harden/register/index.html Tue, 05 May 2020 13:15:09 -0400 http://localhost:8080/illumio_basic/3.harden/register/index.html The best way to enforce microsegmentation on our server is to pair it by installing the Illumio agent on it. This is not absolutely necessary to enforce basic segmentation but it does give us the highest degree of traffic monitoring and control. Note You will see the terms PCE and VEN used throughout the rest of these labs. The Illumio Core consists of two key components — the Policy Compute Engine (PCE) and the Virtual Enforcement Node (VEN). The PCE is the server side of the Illumio platform. It is the segmentation policy controller and the central manager for the VEN. The VEN is the agent that is installed on your workloads. http://localhost:8080/illumio_basic/3.harden/verify/index.html Tue, 05 May 2020 13:15:09 -0400 http://localhost:8080/illumio_basic/3.harden/verify/index.html Run the exit command to switch back to our standard user then re-run the port scan from earlier by executing nmap 192.168.40.0/24 Info The port scan will take significantly longer to run this time as much the network is effectively invisible to our compromised host. Those among us who are impatient can press the enter key to get an update on how far along the port scan is. http://localhost:8080/illumio_basic/3.harden/review/index.html Tue, 05 May 2020 13:15:09 -0400 http://localhost:8080/illumio_basic/3.harden/review/index.html Now let’s review our workload and explore the traffic logs. Browse to the workload view then click the name of your server: From here we can do a variety of things, including viewing the traffic rules that are applied: And accessing near-real-time information about blocked traffic, including our recent port scan attempt.