Bahrain, Saudi Arabia
IllumioStop one compromised system from becoming a network-wide breach
Illumio maps how your servers, cloud workloads, containers and endpoints communicate, then enforces segmentation policy on each host so an attacker who gets in cannot move freely.
- Host-based enforcement
- An agent programs each host’s own firewall, such as Windows Filtering Platform or iptables
- Label-based policy
- Rules follow a workload’s role, not its IP address
- SaaS or on premises
- The policy engine is hosted by Illumio or run in your own environment
- Test before you block
- Draft policy shows what it would block before it is enforced
Problems Illumio is designed to solve
Perimeter firewalls control traffic in and out of the network. Most ransomware and breaches do their damage by moving between systems inside it, which is called lateral movement.
| Topic | What it can lead to | How Illumio helps |
|---|---|---|
| A flat internal network | What it can lead to: One infected laptop or server can reach almost everything, so ransomware spreads quickly. | How Illumio helps: Segmentation policy allows only the connections each workload needs and blocks the rest at the host. |
| No clear picture of which systems talk to which | What it can lead to: Segmentation projects stall because nobody wants to break an application they do not fully understand. | How Illumio helps: Illumio maps connections across cloud workloads, on-premises servers, containers and endpoints, and suggests policy from observed traffic. |
| Firewall rules written against IP addresses | What it can lead to: Rules sprawl and break when workloads move, scale or change address. | How Illumio helps: Policy is based on labels such as application, environment and role, so it follows the workload wherever it runs. |
| Fear that a new rule will cause an outage | What it can lead to: Changes are delayed or avoided, and exposure stays open. | How Illumio helps: Policy can be modelled in draft to show what it would block. In visibility modes the agent blocks nothing until you choose to enforce. |
| Different controls in each cloud and data centre | What it can lead to: Inconsistent protection and no single view of risk. | How Illumio helps: One view of application communication across Azure, AWS, Google Cloud, Oracle Cloud and the data centre. |
| Slow containment during an incident | What it can lead to: Attackers keep moving while teams work out which connections to cut. | How Illumio helps: Illumio Insights offers one-click containment, and compromised devices can be quarantined, managed or unmanaged. |
What Illumio does
Illumio has two main products: Illumio Segmentation, which sets and enforces policy, and Illumio Insights, which looks for lateral movement and risky traffic.
Traffic visibility and mapping
Shows real connections between workloads, applications and devices across hybrid and multi-cloud environments.
Label-based policy
Write rules in business terms, such as "production web servers may talk to production databases", rather than lists of IP addresses.
Host-based enforcement
A user-space agent receives policy from Illumio’s Policy Compute Engine and programs the host’s native firewall, without a reboot or changes to network firewalls.
Policy testing
Model rules in draft and run in visibility mode to see what would be blocked before enforcement begins.
Illumio Insights
Agentless analysis of east-west traffic to detect lateral movement, overly permissive access and unusual outbound activity.
Containment
Isolate compromised workloads or devices quickly so an incident stays small while it is investigated.
Illumio compared with traditional network segmentation
Traditional segmentation uses VLANs and network firewalls. Illumio works at each host instead. Many organisations use both.
| Topic | Traditional segmentation (VLANs and firewalls) | Illumio |
|---|---|---|
| Where rules are enforced | Traditional segmentation (VLANs and firewalls): At network firewalls and switches between zones. | Illumio: On each host, through the operating system’s own firewall. |
| What rules are based on | Traditional segmentation (VLANs and firewalls): IP addresses, subnets and VLANs. | Illumio: Labels describing the workload, such as application, environment and role. |
| Traffic inside a zone | Traditional segmentation (VLANs and firewalls): Usually not controlled: systems in the same VLAN can reach each other. | Illumio: Controlled between individual workloads, even in the same subnet. |
| Effect of moving or scaling a workload | Traditional segmentation (VLANs and firewalls): Rules often need rewriting when addresses change. | Illumio: Rules follow the labels, so they apply wherever the workload runs. |
| Testing a change | Traditional segmentation (VLANs and firewalls): Usually tested by applying it during a change window. | Illumio: Modelled in draft or visibility mode before enforcement. |
Illumio does not require changes to your existing firewall setup. Perimeter and network firewalls still have a role at the edge of the network.
Is your environment ready for segmentation?
Eight points to settle before any segmentation project, with Illumio or any other tool. Tick what is already true: nothing you select is saved or sent.
How VirtuThinko helps you adopt Illumio
- 01
Requirements
We can help you define what you need Illumio to solve, which environments are in scope and how success will be judged.
- 02
Demo or proof of concept
We can arrange a demonstration or a proof of concept that maps traffic for a few applications in visibility mode, without blocking anything.
- 03
Design and deployment
We can help define your labelling scheme, plan agent rollout in waves, and design policy for priority applications with your application owners.
- 04
Tuning and handover
We can help move applications from visibility to enforcement in stages, review blocked traffic, and hand over runbooks for exceptions and new workloads.
- 05
Ongoing support
Where you want it, we can support Illumio after go-live, including health checks, upgrades and changes as your environment grows.
No. Illumio enforces policy on each host and does not require changes to your firewall setup. Network firewalls still control traffic at the edge and between major zones.
Illumio Segmentation uses a tamper-resistant agent that runs in user space and can be deployed without a maintenance window or reboot. For cloud workloads Illumio says it can tighten enforcement with or without an agent, and Illumio Insights is deployed agentlessly.
Illumio documents SaaS, on-premises and hybrid models for its Policy Compute Engine (PCE). In SaaS, Illumio hosts and manages the PCE; on premises, you run its compute, storage, certificates and upgrades. Agents are managed by you in both models.
It can if rules are enforced before traffic is understood. Illumio lets you model draft policy and run agents in modes that block nothing, so you can review what would be blocked before enforcing.
Illumio lists physical servers, virtual machines, containers and IT/OT systems in the data centre, Azure, AWS, Google Cloud and Oracle Cloud workloads, and endpoints.
Explore Illumio for your organisation
Share the environments you want to protect, roughly how many servers and workloads are involved, and the applications that matter most. A member of our team will contact you to arrange an initial conversation.