Implements microsegmentation with Akamai Guardicore Segmentation to map application dependencies, visualize east-west traffic flows, and create granular, least-privilege network policies across VMs, containers, bare metal, and cloud. Use when blocking lateral movement in a data center or when PCI DSS/HIPAA compliance requires validated network segmentation.
Implements microsegmentation with Akamai Guardicore Segmentation to map application dependencies, visualize east-west traffic flows, and create granular, least-privilege network policies across VMs, containers, bare metal, and cloud. Use when blocking lateral movement in a data center or when PCI DSS/HIPAA compliance requires validated network segmentation.
When implementing east-west traffic controls to prevent lateral movement within data centers
When needing application-level visibility into network communication patterns before writing segmentation policies
When segmenting workloads across heterogeneous environments (VMs, containers, bare metal, cloud)
When compliance frameworks (PCI DSS, HIPAA) require network segmentation validation
When deploying zero trust at the network layer with process-level granularity
Do not use for perimeter-only security (use traditional firewalls), for environments with fewer than 50 workloads where VLANs/security groups suffice, or when network team lacks capacity for ongoing policy management.
Prerequisites
Akamai Guardicore Segmentation license (Enterprise or Premium)
Guardicore Management Server deployed (on-prem or SaaS)
Agent deployment access to target workloads (Linux, Windows, Kubernetes)
Network visibility: SPAN/TAP ports or VPC flow logs for agentless collection
Application owner engagement for dependency validation
Workflow
Step 1: Deploy Guardicore Agents on Workloads
Install agents to collect process-level network communication data.
Guardicore Insight: Analytics engine for compliance reporting and segmentation effectiveness measurement
Common Scenarios
Scenario: PCI DSS Microsegmentation for E-Commerce Platform
Context: An e-commerce company must isolate its Cardholder Data Environment (CDE) from the rest of the corporate network for PCI DSS compliance. The CDE spans 200 servers across on-prem and AWS.
Approach:
Deploy Guardicore agents on all 200 CDE servers and 300 non-CDE servers
Run Reveal for 2 weeks to map all communication patterns into and out of the CDE
Identify and remediate unexpected flows (e.g., dev servers connecting to production CDE)
Create ring-fence policy blocking all non-CDE to CDE traffic by default
Create explicit allow policies for validated CDE communication paths
Test in Reveal mode for 1 week, validate no legitimate traffic blocked
Switch to enforcement mode and monitor for violations
Pitfalls: Agent deployment on legacy systems (Windows Server 2012) may require manual installation. Ring-fence policies must account for management traffic (monitoring, patching, backup). Start with broad allow rules and progressively tighten. Application owners must validate dependency maps before enforcement.
