Research on the Effect of Micro-Segmentation Products in Suppressing Lateral Movement Based on the Idea of Attack Surface Measurement

Abstract

The escalating threat of lateral movement within networks presents a significant challenge, compounded by the slow progress in the standardization of micro-segmentation products. In response, this study introduces a novel evaluation framework grounded in attack surface measurement theory. This framework encompasses a methodology and a set of quantitative indicators designed to assess the efficacy of micro-segmentation products in curbing lateral movement. Validation was conducted using empirical data from controlled lab environments and diverse real-world business scenarios, confirming the framework’s robustness and broad applicability. Our findings indicate that micro-segmentation significantly reduces the attack surface associated with lateral movement, effectively addressing the well-documented limitations of traditional perimeter-based security models in protecting east-west traffic. The evaluation methodology and quantitative indicator system developed in this study constitute the first benchmark framework for assessing micro-segmentation products’ capabilities from an attack surface perspective. Characterized by cost-effectiveness and ease of implementation, this framework can support the testing and evaluation of micro-segmentation products, the development of relevant standards, and promote their broader adoption.