Illumio Uses Microsegmentation to Contain Breaches

Illumio provides microsegmentation to block movement within systems, including servers and cloud environments, as AI-enabled cyberattacks spread rapidly after an intrusion. The company says prevention and detection alone cannot keep pace with machine-speed attacks, so it focuses on limiting damage even when an initial breach cannot be avoided. Founded in 2013, Illumio was the first in the industry to commercialize a method that sets security policies using labels for location, environment, application and role instead of IP addresses.

Illumio Segmentation visualizes communications among servers, clouds, containers and endpoints in an AI security graph, then allows only traffic needed for business operations. If an attacker takes control of a web server, for example, the system restricts routes to financial systems or customer-data databases. It manages data centers and multicloud environments under one policy framework, and can isolate a confirmed threat workload with one click.

Its agent runs in user space without installing a separate module in the operating system kernel. The product uses an out-of-path design: it configures policies in the operating system’s built-in firewall rather than handling network traffic directly. If the agent has a problem, service traffic continues and existing security policies remain in place; installation also does not require a server reboot.

Policies are based on labels rather than IP addresses, so adding servers does not cause individual rules to multiply in complexity. Illumio analyzes actual communications to recommend application-specific allow policies, and simulates which traffic would be blocked before applying them, allowing a return to prior settings if a problem arises. Organizations can adopt the controls in stages, from blocking high-risk ports to ringfencing critical systems.

A major European bank had operated another microsegmentation product for about three years but had not been able to apply active blocking policies. After switching to Illumio, it deployed the system across 25,000 servers in three months and applied ringfencing for critical services and policies to contain breach spread. Illumio says more than eight of the world’s top 10 financial institutions use its solution to protect critical systems. Microsoft has also deployed it across its internal IT environment, which comprises millions of workloads.

Western Union, which operates money-transfer services in more than 200 countries and territories, isolated its card-payment data systems and passed a PCI DSS 4.0 audit. Cathay Pacific segmented about 600 critical applications in four months without interrupting operations and saved about $5 million in firewall expansion costs. In South Korea, users include internet platform companies, major credit card and securities firms, and financial infrastructure organizations. Illumio is pursuing business growth in response to changes in the country’s security environment, including the Financial Security Institute’s zero-trust guidelines, improvements to network-separation regulations and the National Network Security Framework (N2SF).

Kyung-yoon Yang, head of Illumio Korea, said AI attacks spread internally before people can even check alerts. Yang said the success of microsegmentation depends on whether organizations can operate it in practice, rather than simply on whether the product works, and said security needs to shift its focus from preventing intrusion to stopping spread after intrusion. Illumio said it aims to strengthen South Korean companies’ and institutions’ ability to contain breaches.

Illumio provides microsegmentation to block movement within systems, including servers and cloud environments, as AI-enabled cyberattacks spread rapidly after an intrusion. The company says prevention and detection alone cannot keep pace with machine-speed attacks, so it focuses on limiting damage even when an initial breach cannot be avoided. Founded in 2013, Illumio was the first in the industry to commercialize a method that sets security policies using labels for location, environment, application and role instead of IP addresses.

Illumio Segmentation visualizes communications among servers, clouds, containers and endpoints in an AI security graph, then allows only traffic needed for business operations. If an attacker takes control of a web server, for example, the system restricts routes to financial systems or customer-data databases. It manages data centers and multicloud environments under one policy framework, and can isolate a confirmed threat workload with one click.

Its agent runs in user space without installing a separate module in the operating system kernel. The product uses an out-of-path design: it configures policies in the operating system’s built-in firewall rather than handling network traffic directly. If the agent has a problem, service traffic continues and existing security policies remain in place; installation also does not require a server reboot.

Policies are based on labels rather than IP addresses, so adding servers does not cause individual rules to multiply in complexity. Illumio analyzes actual communications to recommend application-specific allow policies, and simulates which traffic would be blocked before applying them, allowing a return to prior settings if a problem arises. Organizations can adopt the controls in stages, from blocking high-risk ports to ringfencing critical systems.

A major European bank had operated another microsegmentation product for about three years but had not been able to apply active blocking policies. After switching to Illumio, it deployed the system across 25,000 servers in three months and applied ringfencing for critical services and policies to contain breach spread. Illumio says more than eight of the world’s top 10 financial institutions use its solution to protect critical systems. Microsoft has also deployed it across its internal IT environment, which comprises millions of workloads.

Western Union, which operates money-transfer services in more than 200 countries and territories, isolated its card-payment data systems and passed a PCI DSS 4.0 audit. Cathay Pacific segmented about 600 critical applications in four months without interrupting operations and saved about $5 million in firewall expansion costs. In South Korea, users include internet platform companies, major credit card and securities firms, and financial infrastructure organizations. Illumio is pursuing business growth in response to changes in the country’s security environment, including the Financial Security Institute’s zero-trust guidelines, improvements to network-separation regulations and the National Network Security Framework (N2SF).

Kyung-yoon Yang, head of Illumio Korea, said AI attacks spread internally before people can even check alerts. Yang said the success of microsegmentation depends on whether organizations can operate it in practice, rather than simply on whether the product works, and said security needs to shift its focus from preventing intrusion to stopping spread after intrusion. Illumio said it aims to strengthen South Korean companies’ and institutions’ ability to contain breaches.