Basic Policy - Core Services + Ransomware

The Basic Policy – Core Services + Ransomware package establishes the customer's first operational segmentation policies by defining shared infrastructure communications and implementing controls that reduce ransomware propagation risk.

The engagement begins by identifying business-critical shared services and administrative platforms used throughout the environment. These services are organized into a documented Core Services policy framework designed to support future segmentation efforts. Core services are broadly defined as global or administrative services consumed across the environment, such as Active Directory, DNS, DHCP, endpoint management platforms, vulnerability scanners, monitoring systems, and similar support infrastructure.

Once the core-services foundation is established, Illumio Professional Services implements ransomware-containment controls focused on restricting high-risk protocols commonly leveraged for lateral movement. Because containment rules can interact with core-service communications, the engagement includes an iterative review that revisits core-services policy as risky protocols are restricted.

The resulting policy framework serves as the customer's baseline segmentation architecture and creates the policy foundation required for Ringfencing, Environmental Separation, and future policy development.

Package Dependencies

• Platform Foundation Deployment
• Labeling
• Discovery  

Strongly Recommended Packages

• Segmentation Strategy & Roadmap  

Technical Readiness

• Operational PCE
• Visibility data available for the agreed scope
• Discovery findings available
• Required IP Lists and Unmanaged Workloads created
• Labels established for the agreed in-scope workload population
• Customer-approved application inventory available  

Customer Readiness

• Project sponsor assigned
• Technical point of contact assigned
• Core-service owners identified
• Application stakeholders available
• Security stakeholders available
• Change-management process defined

Core Services Analysis and Design

• Review Discovery findings and available traffic data.
• Identify shared infrastructure and administrative services in scope.
• Validate core-service communication requirements with stakeholders.
• Review operational dependencies and consumption patterns.
• Define reusable policy structures and policy hierarchy.
• Define the customized architectural configuration structure for core-services policy.
• Identify required exceptions and document their rationale.

Customer Outcome

Customer receives a validated architectural model for shared-services policy that can be reused and extended as additional services are onboarded.

Core Services Policy Implementation and Handoff

• Implement core-services policy for up to ten (10) approved core-service applications.
• Create and organize required policy objects and rule structures.
• Validate policy against observed and approved communications.
• Document implemented policy structure and associated objects.
• Provide a reference guide describing core-services policy structure, construction methodology, and maintenance practices.
• Document exception-management guidance and future core-services onboarding guidance.
• Review implemented policy and documentation with customer stakeholders.

Customer Outcome

Customer has an implemented and documented core-services policy framework and the reference material required to continue expanding and maintaining it independently.

Ransomware Containment Design and Implementation

• Review the standard high-risk protocol list and customize where requested.
• Design the deny-rule framework used to restrict high-risk protocols.
• Implement containment controls for up to ten (10) approved risky protocols, commonly beginning with RDP and SSH and typically including protocols such as Telnet, FTP, and SMB.
• Validate the impact of containment rules on core-service communications.
• Iteratively revisit and adjust core-services policy where containment rules interrupt required communications.
• Create and document approved exceptions and their rationale.

Customer Outcome

Customer receives implemented containment controls that reduce lateral-movement risk while preserving required core-service communications.

Ransomware Containment Documentation and Handoff

• Document blocked protocols, approved exceptions, and exception rationale.
• Add ransomware-containment content to the customer policy reference documentation.
• Provide an as-built record of implemented policy, rule organization, and associated objects.
• Document ransomware-policy administration and future protocol-evaluation guidance.
• Document recommended containment-expansion approach and operational ownership.
• Review implemented controls and documentation with customer stakeholders.

Customer Outcome

Customer has a documented containment framework, a record of blocked protocols and exceptions, and the operational guidance required to maintain and expand ransomware controls after Professional Services disengagement.

The delivery schedule will be established at project initiation based on:

• Package size
• Number of core-service applications
• Number of risky protocols selected
• Discovery readiness
• Label quality
• Stakeholder availability
• Customer review and approval cycles.

Delays in dependency validation, exception decisions, or change approvals may affect the delivery schedule.

Talk to our Sales team to learn more about Services.

Explore our Professional Services at illumio.com/services/professional-services