Technology1 min read

Using mathematics to validate network configurations

By · Published by Everything Blog

In short

Critical enterprises rely heavily on network segmentation to keep sensitive workloads completely isolated from unauthorized access. Traditional validation methods sent test packets across segments, but modern network sizes made comprehensive verification impossible and limited checks to mere sampling. By using the automated-reasoning tool Tiros, configurations can instead undergo static analysis as frequently as every hour without generating live traffic. In systems like AWS Cloud WAN, specialized software transforms route tables and policies into logical formulas, allowing the tool to mathematically confirm no unauthorized paths exist.

Key points

  • Static analysis of logical rules allows organizations to achieve exhaustive mathematical…: Static analysis of logical rules allows organizations to achieve exhaustive mathematical proof of network segmentation.
  • Network administrators receive immediate alerts whenever reachability analysis detects di…: Network administrators receive immediate alerts whenever reachability analysis detects discrepancies against intended isolation policies.
  • Automated reasoning eliminates reliance on live traffic sampling when confirming the tota…: Automated reasoning eliminates reliance on live traffic sampling when confirming the total absence of unauthorized paths.

Sources checked by our analysis pipeline: 1

Corporations, banks, hospitals, and academic institutions all rely on wide-area networks (WANs) to connect their local networks across geographic regions. Within a WAN, however, it’s often necessary to isolate different computational resources from each other: for example, coding environments used to test new website features should remain separate from active websites.

Customers rely on such isolation — or segmentation — to help protect sensitive data; a single misconfiguration of segmentation rules could allow traffic to reach unintended parts of a network or allow data to cross organizational boundaries.

Historically, validating network segmentation has involved mapping the network by sending packets through it. The size and complexity of modern networks, however, make it impractical to build a complete map this way, so organizations instead rely on a sampling process that sends packets through only portions of the network. The result is that network segmentation is rarely validated exhaustively.

By using Tiros, Amazon Web Services’ automated-reasoning tool for analyzing network connectivity, we’re offering an alternative to dynamic sampling that is designed to validate segmentation across all modeled paths.

Previously, Tiros had been…

Technology