Security vendor Illumio engaged penetration testing provider Bishop Fox to design a series of emulated attacks to test the effectiveness of zero-trust segmentation (also known as microsegmentation). The result showed that the team took 10 minutes to stop the ransomware attack using Illumio Core and endpoint detection and response (EDR) services.

The test, which mapped to the MITRE ATT&CK framework, was based on real threat actors’ tactics, techniques, and procedures (TTPs), and ran a series of five attack scenarios to measure the number of successfully compromised hosts, time taken by the attacker to complete the scenario, and the number of TTPs that were successfully executed.

“The key here was we wanted to keep all of our test scenarios from an attack perspective consistent,” Trevin Edgeworth, the red team practice director at Bishop Fox, told SDxCental. 

What Bishop Fox did to protect against bias was to differentiate the red and blue team roles, and make sure the red team, aka the attackers, do not change their tactics and follow the same script with the same amounts of delays no matter what they learned from previous tests. Additionally, the team built a complex enterprise network entirely in the cloud and heavily used automation for consistency. 

The findings showed that the attacker breached all hosts within 2.5 hours in a network without any protection, and all 26 TTPs were executed. For the networking using EDR, the “adversary” moved beyond its initial point of entry, 12 of the 13 TTPs executed, and it took 38 minutes for EDR services to stop the attack; in the scenario with both EDR and Illumio Core microsegmentation services, the “bad actors” could not move beyond the first compromised host, six of the eight TTPs enacted, and it took 10 minutes to stop the attack.

To interpret this result, only comparing the time can be risky, and “ultimately our goal as defenders is to delay attacks, is to take away that adversaries preferred attack method,” Edgeworth pointed out. 

“I would say the measure of the amount of TTPs they're able to actually get through is a great metric. But the numbers should also not be discounted in that [test]. This was two hours of activities that we were able to reduce down to 10 minutes,” he added.

Zero trust is described as a philosophy, an approach, or a security strategy. How to measure a security strategy? You use specific controls that align with that philosophy, like segmentation and zero trust in this test, Illumio founder and CTO PJ Kirner said.

“There's a lot of theoretical out there around zero trust and people proposed the model and they say these are principles you should follow and people just kind of accept it,” Edgeworth said. “But in my experience, nothing does a better job of proving than an actual reality …so this really is kind of where the rubber meets the road in terms of proving out zero trust to me.”

“What I learned is there is more and more need for this kind of research and there's demand for people wanting to understand security controls in this way …thinking about it from a more scientific and metrics-driven point of view,” Kirner said. “So I think it's really piqued a lot of curiosity in people's minds.”