Why Perimeter Security No Longer Works
Traditional network security has focused on defending the "perimeter." This structure divides the external and internal networks with a firewall, operating on the premise that any traffic that has entered the internal network is trustworthy. Consequently, devices such as VPNs, NACs, and multi-factor authentication share the common limitation of verifying access "only up to the point of crossing this perimeter."
While this model was reasonable when the work environment was confined to a single physical office building or a closed private network, today’s IT environment has completely shattered that premise. With the rise of remote and hybrid work, access points have diversified; the adoption of cloud and SaaS has dispersed data and applications outside the corporate network; and devices like IoT and OT, which are inherently difficult to secure with strong authentication, remain constantly connected to the internal network. In essence, the very concept of a perimeter has blurred.
A more decisive shift has occurred in attack methodologies. A typical pattern in recent ransomware and APT attacks is not "breaching the outer wall," but rather "using a single vulnerable point as a stepping stone to move laterally and vertically inside." In fact, multiple incident analyses reveal that several stages of internal movement exist between the initial access point and the final target of damage (such as core databases or domain controllers). Whether an attacker can navigate these stages freely determines whether an incident remains "an isolated endpoint issue" or escalates into "a company-wide data breach."
How Lateral Movement Works
Lateral movement refers to a series of actions where an attacker leverages the privileges and network accessibility of an initial compromise point to move to other systems within the internal network. It is treated as a critical stage in modern attack chains, to the extent of being classified as a distinct tactics category in the MITRE ATT&CK framework.
There are two fundamental reasons why this process is possible:
First, Implicit Trust. In a network structure where communication is permitted simply because devices share the same VLAN or internal IP range, an infected endpoint is recognized as an 'internal member' and can communicate with other servers without additional verification.
Second, Over-Provisioned Access. Privileges granted for specific tasks are often broader than what is actually required. Representative examples include developer accounts having access all the way to production servers, or a single department's PC having unrestricted access to company-wide shared resources. Once an attacker compromises a single endpoint, they inherit these overly broad privileges.
Existing defensive measures, such as VLAN segmentation or firewall policies, only partially address this issue. VLANs merely divide networks into subnet units and, in most cases, fail to control communication between individual endpoints within the same subnet. Firewall policies are also largely focused on traffic directing "internal → external" or "external → internal," leaving east-west traffic within the internal network virtually defenseless.
Zero Trust and Micro-Segmentation as Alternatives
Against this backdrop, the concept of Zero Trust emerged. As defined in NIST SP 800-207, the core tenet of Zero Trust is the principle of "never trusting based on network location." Every access attempt, whether by a user or a device, must have its identity and authority verified, and access is granted only to the minimum necessary resources.
The technology that implements this principle at the network layer is Micro-Segmentation. While traditional segmentation divided networks into broad categories like "by department" or "by VLAN," micro-segmentation defines permissible communication ranges much more granularly at the level of users, workloads, and applications. For example, precise policies can be applied such that "the development team's PCs can only access development servers, and the customer database server can only be accessed by specific accounts that have undergone separate authentication."
There are three main approaches to implementing micro-segmentation: Host Agent-Based: This method controls communication by installing an agent on each server and PC. While it allows for granular control, legacy systems where agents cannot be installed, as well as IoT and OT devices, are excluded from the protection scope.
Hypervisor/SDN-Based: This method controls traffic at the virtualization or Software-Defined Networking (SDN) layer. While suitable for cloud-native environments, it often fails to cover physical network segments on-premises.
Network Switch-Based: This method controls communication directly at the L2/L3 switch level. It is characterized by its ability to physically include all connected devices (PCs, printers, CCTVs, IoT equipment, etc.) within the protection scope, regardless of whether an agent can be installed.
Each of these three methods has its own applicable domain, but because actual enterprise environments typically mix legacy systems, agentless devices, and physical network segments, relying on a single approach is highly likely to leave security blind spots.
세 방식 모두 나름의 적용 영역이 있지만, 실제 기업 환경은 레거시 시스템·에이전트 설치 불가 장비·물리 네트워크 구간이 혼재된 경우가 대부분이라, 어느 한 방식만으로는 사각지대가 남기 쉽다.
PIOLINK TiFRONT ZT: Switch-Level Micro-Segmentation
PIOLINK's TiFRONT ZT adopts the network switch-based approach. Without the need to install separate agents or introduce additional security appliances, it implements user- and workload-level access control within existing L2/L3 switch segments.
It delivers two core capabilities:
First, by utilizing the switch itself as a sensor, it identifies all devices connected to the internal network—including IoT and OT equipment where agent installation is impossible—and visualizes their communication status.
Second, it segments the network by user roles and workloads, ensuring that even if a specific endpoint is compromised, unauthorized communication with other resources is blocked at the source. In short, it narrows the communication paths where lateral movement can occur directly at the switch level.
The practical benefit of this approach lies in its low deployment barrier. Instead of deploying agents across the entire enterprise system or redesigning the network architecture, organizations can progressively build a Zero Trust environment by simply upgrading their existing switch infrastructure.
Micro-Segmentation: Transitioning from Option to Requirement
In Korea, the National Network Security Framework (N2SF) is being designed on the premise of adopting Zero Trust Architecture. Globally, since the US Federal Government's mandate on Zero Trust (EO 14028), related requirements are rapidly expanding into the private sector. With ransomware propagation methods increasingly relying on internal lateral movement, micro-segmentation is no longer a "premium option" but is becoming a foundational premise of internal network design.
The key ultimately lies in "how to achieve practical segmentation without the burden of implementation." Finding a method that simultaneously addresses the three practical constraints—limitations of agent installation scope, security gaps in legacy/IoT devices, and infrastructure reconstruction costs—will be the core of any micro-segmentation deployment strategy.
|
