<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-microsegmentation
description: >-
  Implement network microsegmentation using software-defined networking, service mesh
  policies, cloud security groups, and host-based firewalls to enforce least-privilege
  east-west traffic controls and limit lateral movement.
domain: cybersecurity
subdomain: security-architecture
tags:
  - microsegmentation
  - network-security
  - lateral-movement
  - service-mesh
  - calico
  - security-groups
  - zero-trust-network
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021"]
---

# Implementing Microsegmentation

## Overview

Microsegmentation enforces fine-grained network access controls at the workload
level, preventing lateral movement even after perimeter breach. This skill covers
implementing microsegmentation using Kubernetes NetworkPolicies, Calico, cloud
security groups, and host-based firewalls.

Mode: `[MODE: ARCHITECT]` — Network security architecture.

## Prerequisites

| Requirement | Details |
|---|---|
| Network topology documentation | Required |
| Kubernetes cluster with CNI supporting NetworkPolicy (Calico, Cilium) | Required |
| Cloud provider access for security group management | Required |
| Python 3.10+ | Required |

## Key Concepts

### Microsegmentation Architecture

```
Traditional Segmentation          Microsegmentation
┌──────────────────────┐          ┌──────────────────────┐
│    Flat Network      │          │  ┌───┐  ┌───┐  ┌───┐│
│  ┌───┐ ┌───┐ ┌───┐  │          │  │ A │──│ B │  │ C ││
│  │ A │ │ B │ │ C │  │          │  └───┘  └───┘  └───┘│
│  └───┘ └───┘ └───┘  │          │    │      ▲          │
│  Any-to-any traffic  │          │    └──────┘          │
└──────────────────────┘          │  Policy-controlled   │
                                  └──────────────────────┘
```

### Kubernetes NetworkPolicy

```yaml
# Default deny all ingress and egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
# Allow frontend to backend on port 8080 only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080
---
# Allow backend to database on port 5432 only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-db
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: backend
      ports:
        - protocol: TCP
          port: 5432
```

### Calico GlobalNetworkPolicy

```yaml
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: deny-lateral-movement
spec:
  order: 100
  selector: "environment == 'production'"
  types:
    - Ingress
    - Egress
  ingress:
    - action: Deny
      source:
        selector: "environment != 'production'"
  egress:
    - action: Allow
      destination:
        selector: "role == 'dns'"
        ports: [53]
    - action: Deny
      destination:
        selector: "environment != 'production'"
```

### AWS Security Group Microsegmentation

```bash
# Create security groups per service tier
aws ec2 create-security-group --group-name "frontend-sg" \
  --description "Frontend tier" --vpc-id vpc-123

aws ec2 create-security-group --group-name "backend-sg" \
  --description "Backend tier" --vpc-id vpc-123

aws ec2 create-security-group --group-name "database-sg" \
  --description "Database tier" --vpc-id vpc-123

# Frontend: allow HTTPS from ALB only
aws ec2 authorize-security-group-ingress --group-id sg-frontend \
  --protocol tcp --port 443 --source-group sg-alb

# Backend: allow 8080 from frontend only
aws ec2 authorize-security-group-ingress --group-id sg-backend \
  --protocol tcp --port 8080 --source-group sg-frontend

# Database: allow 5432 from backend only
aws ec2 authorize-security-group-ingress --group-id sg-database \
  --protocol tcp --port 5432 --source-group sg-backend
```

### Host-Based Microsegmentation (iptables)

```bash
# Allow only specific service communication
iptables -A INPUT -p tcp --dport 8080 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

# Log denied traffic for visibility
iptables -A INPUT -j LOG --log-prefix "MICROSEG-DENY: " --log-level 4
iptables -A INPUT -j DROP
```

## Workflow

### Step 1: Map Traffic Flows

```bash
node scripts/agent.js --action discover --source flow-logs
```

### Step 2: Generate Policies

```bash
node scripts/agent.js --action generate --platform kubernetes --output policies/
```

### Step 3: Validate Policies

```bash
node scripts/agent.js --action validate --policies policies/
```

### Step 4: Deploy in Monitor Mode

```bash
node scripts/agent.js --action deploy --mode monitor --policies policies/
```

## Detection

```yaml
title: Microsegmentation Detection
id: 4d23ef4d-6a77-4c31-a681-c8d35dbfa30b
status: experimental
description: Detects suspicious activity related to implementing microsegmentation techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1021
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Microsegmentation Detection | firewall/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1021 |

## Verification

- [ ] Default deny policy applied to all namespaces/segments
- [ ] Only documented traffic flows permitted between services
- [ ] East-west traffic encrypted with mTLS where possible
- [ ] Denied traffic logged and forwarded to SIEM
- [ ] Policy changes require approval workflow
- [ ] Lateral movement tested and confirmed blocked
- [ ] Emergency bypass procedures documented

## References

- [Kubernetes Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
- [Calico Network Policy](https://docs.tigera.io/calico/latest/network-policy/)
- [AWS Security Groups](https://docs.aws.amazon.com/vpc/latest/userguide/security-groups.html)
