From asi
Configure microsegmentation policies using VMware NSX, Illumio, Calico for zero trust architectures to enforce least-privilege workload access and prevent lateral movement.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- Understanding of zero trust principles (NIST SP 800-207)
Configure microsegmentation policies with VMware NSX, Illumio, Calico for zero trust workload isolation, preventing lateral movement in networks.
Configures microsegmentation for zero-trust architectures to enforce least-privilege access between workloads at application layer, preventing lateral movement and replacing VLANs. Uses Illumio, VMware NSX, Guardicore.
Implements microsegmentation with Akamai Guardicore: maps app dependencies, creates granular policies, visualizes east-west traffic, enforces least-privilege across data centers/cloud. For zero-trust network security.
Share bugs, ideas, or general feedback.
Microsegmentation divides a network into granular security zones, enforcing least-privilege access between workloads at the application layer rather than relying on traditional VLAN-based segmentation. In a zero trust architecture, microsegmentation eliminates implicit trust between workloads within the same network segment, preventing lateral movement even after an attacker gains initial access.
This skill covers designing microsegmentation policies using workload identity, implementing host-based and network-based enforcement, and validating segmentation effectiveness with tools like Illumio Core and VMware NSX.
Traditional Segmentation Microsegmentation
┌─────────────────┐ ┌──────────────────────┐
│ VLAN 10 │ │ Workload A ←policy→ │
│ ┌───┐ ┌───┐ │ │ Workload B ←policy→ │
│ │ A │ │ B │ │ │ Workload C ←policy→ │
│ └───┘ └───┘ │ │ Workload D ←policy→ │
│ (trust each │ │ (zero trust between │
│ other) │ │ every pair) │
└─────────────────┘ └──────────────────────┘
Before creating segmentation policies, discover actual communication flows between workloads using traffic telemetry. Tools like Illumio, Guardicore, and AppDynamics provide application dependency maps showing which workloads communicate, over which ports, and how frequently.
Draft policies in monitor/visibility mode before enforcement. This allows validation that proposed rules will not break legitimate traffic while identifying unnecessary or risky communication paths.
Modern microsegmentation uses labels (role, application, environment, location) instead of IP-based rules. Label-based policies are portable across environments and survive IP changes during migrations.
Isolate critical applications (PCI cardholder data environment, SWIFT financial systems, healthcare PHI) with strict allow-list policies that deny all traffic not explicitly permitted.
Deploy Visibility Agents
Build Application Dependency Map
Assign Labels
Define Segmentation Zones
Create Allow-List Policies
Model Policies in Test Mode
Enforce Incrementally
Validate Segmentation