Stop an attacker from spreading, even once they’re inside

Classic network security is door security: the firewall stands at the perimeter and screens what comes from outside. But a large share of attacks walk in through the door — the laptop of an employee who clicked a phishing email becomes the attacker’s first foothold inside. In a classic network, everything past that point is open: servers can reach each other freely, and the attacker moves laterally.

In a software-defined network, the rule is written not at the network’s edge but in front of every server. A sample rule set:

• The accounting application reaches the database only on the database port.
• Nothing but the application server can reach the database at all.
• Remote desktop and file sharing between servers open only from the management network.

In this picture, the compromised laptop’s visible world shrinks to a few ports; the attacker’s first lateral move hits a rule and lands in the logs. A rule that lives in the virtualization layer has one more consequence: wherever a server moves physically, its rules move with it. The maintenance lists that try to keep network device configuration in sync with the server inventory simply disappear.