What should be used to protect against lateral movements during a Cisco NFVI security breach?

Lateral movement describes the techniques attackers use to move through a network after gaining initial access to a single host. Network segmentation is a fundamental security control designed to counter this threat. By dividing the network into smaller, isolated segments (or micro-segments for individual workloads), it contains a breach within its zone of origin. All traffic attempting to cross a segment boundary must pass through a security enforcement point, such as a firewall, where it can be inspected and blocked. This directly hinders an attacker's ability to pivot from a compromised system to other critical assets within the Cisco NFV Infrastructure (NFVI).

A. Wi-Fi Protected Access: This is a security protocol for wireless (802.11) networks. It is irrelevant to preventing lateral movement within a wired and virtualized NFVI data center environment.

B. Web application firewall: A WAF protects web applications from Layer 7 attacks (e.g., SQL injection) originating from external users (north-south traffic), not internal lateral movement between servers (east-west traffic).

D. Data encryption: Encryption protects the confidentiality of data at rest and in transit. While critical, it does not prevent an attacker from compromising a host and using it to move to other systems.

1. Cisco Systems, Inc. (2016). Cisco NFV Infrastructure Security. White Paper, Page 10.

"Segmentation is a key security control to prevent lateral movement of threats within the data center. In a virtualized environment, segmentation can be implemented at a very granular level, a concept known as microsegmentation. With microsegmentation, security policies can be applied between individual workloads..." This document directly links segmentation and micro-segmentation to the prevention of lateral movement within an NFVI context.

2. Cisco Systems, Inc. (2017). SAFE Reference Guide. Cisco Validated Design (CVD), Page 11.

In the "Threats" section, under "Malware," it states: "Once inside, it can propagate through lateral movement... The Places in the Network (PINs) are segmented from each other to limit the scope of a breach." This establishes segmentation as a core SAFE architecture principle for limiting lateral movement.

3. Gill, S., & Tredan, G. (2020). Security for Virtualized Networks. In Network and System Security (pp. 1-15). Springer, Cham. DOI: https://doi.org/10.1007/978-3-030-64302-01

This academic publication discusses security in virtualized environments, stating, "Micro-segmentation is a security technique that enables fine-grained security policies to be assigned to individual workloads... This helps in preventing the lateral movement of threats within the data center." This corroborates the industry best practice with peer-reviewed research.