Active Incident Segmentation Support

Active Incident Segmentation Support helps organizations stop lateral movement during an active breach. It protects servers that have been confirmed healthy so compromised systems can't reinfect them.

During a breach, a critical task is keeping compromised systems from reaching systems that have been investigated and cleared. Traditional network controls are usually too slow or too coarse to change in the middle of an incident. Illumio segmentation can put workload-level boundaries in place quickly, without redesigning the network.

Illumio Professional Services is not an incident response firm. PS works alongside the IR firm the customer has contracted. The IR firm leads the investigation, forensics, and remediation, and Illumio PS provides segmentation controls to support that work.

PS helps the customer set up an environmental separation rule based on workload state. As the customer and its IR firm sort servers into impacted, cleared, or unknown, PS helps deploy VENs and apply enforcement so that cleared servers refuse traffic from compromised or unverified systems. Protection is enforced on the healthy side of the boundary, so it doesn't depend on getting an agent onto a system that may already be compromised.

PS also gives the customer a blueprint for repeating the method. The customer can then keep classifying, clearing, and protecting workloads as recovery continues, and use the same approach to protect the environment going forward.

This method is temporary by design. It is built for speed during an incident, not for long-term operation. Once the incident is resolved, it can transition into a full Illumio deployment.

This package is usually used by organizations that are new to Illumio or haven't created policy yet.

Package Dependencies

• None  

Incident Readiness

• An incident response firm or internal IR team is engaged and leading the investigation
• An incident commander or single decision-maker is identified
• The customer has authority to make emergency changes to production systems  

Technical Readiness

• Illumio licensing is available, including licensing issued for the incident where applicable
• Access to an Illumio PCE, or the ability to provision one quickly
• Administrative access to in-scope workloads, or a software distribution method, for VEN deployment
• Network connectivity from in-scope workloads to the PCE
• An initial list of in-scope workloads and critical systems  

Customer Readiness

• A primary point of contact available throughout the engagement
• Infrastructure and security staff available to deploy VENs and approve changes
• An emergency change-approval process in place for the incident

Incident Engagement and Coordination

• Establish a working cadence with the customer's incident commander and IR firm.
• Confirm the in-scope environment, critical systems, and containment priorities.
• Confirm how workload state decisions will be made and communicated.
• Confirm emergency change-approval and authorization procedures.

Customer Outcome

The customer, its IR firm, and Illumio PS agree on how segmentation will be used to support the incident response.

Rapid Platform Enablement

• Set up or confirm access to the Illumio PCE.
• Set up the minimum configuration the incident requires, including a label structure for workload state.
• Define the workload state labels: impacted, cleared, and unknown.
• Identify core infrastructure services that must stay reachable, such as identity and name resolution, and the IR tooling access that must be kept.

Customer Outcome

The customer has an Illumio environment ready to support incident segmentation in the shortest practical time.

Incident Separation Rule

• Design an environmental separation rule that prevents cleared workloads from accepting traffic from impacted and unknown workloads.
• Build in approved exceptions for IR tooling, investigation access, and required core services.
• Adjust the rule and its exceptions as the IR firm's findings change.
• Document the rule, the exceptions, and the reason for each change.

Customer Outcome

The customer has a defined boundary that shields healthy servers from compromised or unverified systems and keeps the access the investigation needs.

VEN Deployment and State-Based Enforcement

• Help deploy VENs to in-scope workloads using the customer's available deployment methods, with cleared and critical systems first.
• Apply state labels to workloads as the customer and IR firm classify them.
• With customer authorization, help apply enforcement so cleared workloads refuse traffic from impacted and unknown systems.
• Update workload labels as systems move between states, such as from unknown to cleared.
• Use Illumio visibility to confirm the separation rule is working as intended.

Customer Outcome

Healthy servers are protected from reinfection as they are cleared, so the customer can return them to service with less risk.

Recovery Blueprint and Transition

• Give the customer a blueprint for repeating the classify, clear, and protect method as recovery continues.
• The blueprint covers VEN deployment, state labeling, updating the separation rule, and enforcement.
• Document the configuration at transition, including labels, the separation rule, exceptions, workload states, and enforcement state.
• Document recommendations for removing or refining incident-specific policy once the incident is resolved.
• Recommend a path from temporary incident segmentation to a full Illumio deployment, and identify the packages that support it.
• Review the blueprint and transition documentation with customer stakeholders.

Customer Outcome

The customer can keep recovering and protecting its environment independently, and has a clear path from temporary incident containment to a sustainable Illumio deployment.

This engagement follows the incident. The applicable order defines activation, response times, and hours of coverage.

Effort depends on:

• Purchased package size
• Number of in-scope workloads
• Whether Illumio is already deployed
• How quickly VENs can be deployed
• How quickly workloads are classified
• Availability of the customer and its IR firm.

The engagement ends at the earliest of the following: the customer or IR firm confirms containment is no longer needed, the purchased effort is used up, or the customer transitions to standard Illumio services.

Talk to our Sales team to learn more about Services.

Explore our Professional Services at illumio.com/services/professional-services