Security in NSX: Microsegmentation and Zero Trust

VMware NSX is primarily a software-defined networking platform, but security is a first-class feature rather than an afterthought. Its key security mechanism is microsegmentation, which divides the data center network into logically isolated groups at the workload level rather than at the network perimeter.

Traditional perimeter security models place a single firewall around the entire network. If an attacker breaches that perimeter, they gain broad lateral movement. Microsegmentation counters this by placing firewall policies around individual workloads. A compromised VM is contained within its segment and has little ability to pivot to neighbouring workloads.

• Zero-trust enforcement: Every workload is treated as untrusted by default; policies must explicitly permit communication.
• Policy consistency: NSX propagates security policies across vCenter Server and the underlying hardware, ensuring consistent enforcement throughout the data center.
• Disaster recovery integration: NSX security policies can follow workloads to redundant or recovery facilities, maintaining posture during a failover.

How AppDefense Fits In: Intended-State Security

NSX secures the network layer, but threats can also originate from within a workload itself—malicious or compromised applications that behave unexpectedly. VMware AppDefense addresses this by focusing on application behavior rather than known threat signatures.

AppDefense operates on the concept of the intended state: a baseline that defines what normal looks like for each VM or application. An Intended State Engine (ISE) builds this baseline automatically by communicating with configuration management systems and application automation frameworks to gather information about apps, workloads, and underlying operating systems.

Once the intended state is established, AppDefense continuously monitors VM behavior. Any deviation triggers a response:

• Alerting: Admins receive notifications when a VM behaves outside its intended state.
• Automated remediation: AppDefense can quarantine a suspicious VM, power it off, or delete it entirely—without waiting for manual intervention.

This approach is particularly valuable in large environments where an admin cannot realistically monitor every application manually.

The Service-defined Firewall: A Holistic Security Layer

VMware’s Service-defined Firewall combines the application visibility of NSX with the intended-state intelligence of AppDefense. Running inside the hypervisor itself, it inspects traffic and enforces policy with context that a traditional hardware or perimeter firewall does not have.

A conventional firewall typically makes a binary decision: block or allow. The Service-defined Firewall adds a third option—quarantine—which holds ambiguous or suspicious traffic for further inspection rather than blindly permitting or dropping it. This makes it significantly harder for malicious data disguised as legitimate traffic to slip through.

Key capabilities include:

• Distributed enforcement at the hypervisor level, eliminating blind spots that exist when traffic never traverses a physical firewall appliance.
• Automated policy actions: lock down apps, restrict user access, or isolate data based on real-time behavioral context.
• Protection at both the perimeter and internally—defending against threats that have already penetrated the network edge.

Note: The original source article cited a test by Verodin (a cybersecurity validation firm) claiming the Service-defined Firewall detected and prevented 100% of tested attacks. This figure should be treated with caution—vendor-commissioned or third-party validation tests rarely reflect all real-world threat scenarios. See review notes.

Key Security Acquisitions: CloudCoreo, Intrinsic, and Carbon Black

Between 2018 and 2019, VMware made three notable security acquisitions that extended its capabilities beyond the core hypervisor and networking stack:

CloudCoreo

CloudCoreo focuses on cloud security posture management. It provides configuration and vulnerability assessments across multi-cloud environments, helping teams identify, prioritise, and remediate misconfigurations in public cloud infrastructure. VMware acquired it with the goal of embedding security directly into cloud provisioning and management workflows.

Intrinsic

Intrinsic specialises in application runtime security, particularly for serverless workloads. Its technology uses virtualisation to enforce user-defined policies around JavaScript-based applications and integrates with serverless platforms including AWS Lambda, Azure Functions, and Google Cloud Functions.

Carbon Black

Announced at VMworld 2019, the Carbon Black acquisition was VMware’s most significant security move to date. Carbon Black develops cloud-native endpoint security software with capabilities including:

• Next-generation antivirus and malware detection
• Endpoint detection and response (EDR)
• Threat hunting
• Alert monitoring and incident response

Carbon Black’s technology has since been integrated into VMware’s broader security portfolio under the VMware Carbon Black brand.

Preparing for and Responding to Breaches: Admin Best Practices

Even the most sophisticated tooling does not eliminate the possibility of a breach. Administrators must maintain operational security hygiene to ensure that, when an attack occurs, recovery is fast and data loss is minimal.

Regularly Test Backups

Attackers—particularly ransomware operators deploying variants such as CryptoLocker—frequently target backup infrastructure before triggering the primary attack. Compromising backups first ensures victims have no easy recovery path. Administrators should:

• Schedule regular, automated backup verification to confirm that backup sets are complete and restorable.
• Apply antimalware and antivirus scanning to backup data and replication streams.
• Treat backup systems as part of the attack surface—apply the same patching and access-control discipline as to production systems.

Maintain Airgapped Backup Copies

An airgapped backup is a copy stored offline or on a network segment that is not reachable from production systems. If all backup systems are online and network-connected, a sufficiently advanced attacker can reach and corrupt them all. Airgapping provides a recovery option that survives even a complete compromise of the online environment.

Practical considerations for airgapped backups:

• The frequency of airgapped copies determines the maximum data loss in a worst-case scenario. More frequent copies mean less data at risk.
• Storage constraints often limit how much data can be airgapped. Prioritise the most critical data sets.
• Test restoration from airgapped media on a defined schedule—a backup that has never been tested is not a reliable backup.

Putting It All Together

Securing a VMware environment requires layering complementary controls:

• Network segmentation (NSX): Limit lateral movement by isolating workloads.
• Behavioral monitoring (AppDefense): Detect and respond to anomalous application behavior automatically.
• Hypervisor-level firewall (Service-defined Firewall): Enforce context-aware policy with block, allow, or quarantine actions.
• Endpoint security (Carbon Black): Detect and respond to threats at the endpoint level.
• Cloud posture management (CloudCoreo): Continuously assess and correct cloud misconfigurations.
• Operational discipline: Test and airgap backups, patch systems promptly, and apply least-privilege access controls throughout.

No single product resolves every risk. The combination of purpose-built VMware security tools, well-configured infrastructure, and vigilant administration provides the most robust defence for modern virtualised data centres.

What Is IT Engineering — and How Does It Differ from IT Operations?

There is no single authoritative definition that cleanly separates IT operations from IT engineering. Different employers, teams, and practitioners interpret the terms differently. Unlike civil or electrical engineering, there is no licensing body or mandatory qualification that confers the title of “IT engineer.”

That said, a useful working distinction exists:

• IT operations tends to cover break-fix work, end-user support, help desk tasks, and day-to-day maintenance — keeping systems and users running.
• IT engineering typically encompasses architecture, system builds, project-driven deployments, and structured change management — designing and improving systems rather than merely maintaining them.

In practice, many roles blend both. A systems administrator, for example, manages user accounts and resolves issues (operations), but also decommissions legacy servers and plans infrastructure upgrades (engineering). That overlap is precisely what makes ops experience a credible springboard into engineering positions.

Note: Software developers are sometimes titled “engineers,” but their career path differs significantly from infrastructure and platform engineering. This article focuses on the ops-to-engineering transition within IT infrastructure and platform roles.

How Ops Skills Map to an IT Engineering Job Description

If you are currently in an operations role, start by auditing what you already do. Many ops tasks have a direct engineering equivalent:

The engineering mindset shifts the question from “How do I fix this now?” to “How do I design this so it doesn’t break — and so recovery is fast if it does?” Recognising where your current work already touches architecture and change management is the first step toward framing yourself as an engineer.

How to Move into an IT Engineering Role

Build Skills Deliberately

The most reliable way to gain engineering credibility is to do engineering work, even informally. Set up a non-production lab environment to practice infrastructure builds, test configuration management tools, or replicate architecture patterns used in your organisation. Hands-on experience in a safe environment develops the confidence and vocabulary you will need in engineering discussions.

Seek Out Collaborative Opportunities

Engineering and operations teams frequently work on overlapping problems. Rather than waiting for a formal role change, look for projects where you can contribute engineering thinking from an ops perspective. An IT engineer designing a new disaster recovery site, for instance, benefits from working with a virtualisation administrator who understands VM behaviour, failover constraints, and operational realities on the ground. Offer that insight proactively.

Collaboration works both ways. Engineering colleagues often lack the operational context that makes a design actually serviceable. Framing your ops knowledge as a contribution — not a gap — changes the dynamic of these conversations.

Attend Project Meetings and Change Reviews

Even as an observer, attending engineering project meetings exposes you to design discussions, trade-off decisions, and change management processes. Pay attention to failed or troubled projects — they often teach more than successes. Ask: Was enough effort invested in the design phase? Was testing thorough? Was operational feedback gathered before go-live? With your ops background, you are well positioned to spot these gaps and, eventually, to prevent them.

Pursue Relevant Certifications Strategically

IT engineering job postings often list vendor certifications as preferred or required qualifications. Common examples include certifications from VMware, Microsoft, Red Hat, Cisco, and similar vendors. These credentials serve two purposes: they validate a measurable level of knowledge on a specific platform, and they signal a commitment to professional development.

That said, experience consistently outweighs certifications when employers make hiring decisions. Certifications are most useful when combined with demonstrable, practical experience — not as a substitute for it. Prioritise certifications that are directly relevant to the platforms your target engineering role uses.

The Role of Ops Experience in Engineering Positions

It is rare for an IT engineering role to exist entirely free of operational responsibilities. Engineers who understand the operational consequences of their design decisions build better systems. A new service or a significant infrastructure change will always land on the desks of operations staff — and if the engineering did not account for operational realities, everyone suffers.

This is one reason the DevOps movement has gained traction: siloing engineering and operations creates friction, slower feedback loops, and systems that are architected without operational wisdom. Professionals who can think across both disciplines are increasingly valuable.

The transition from operations to engineering is rarely a single event. Without a formal role change or a move to a new organisation, it tends to be gradual — a growing proportion of engineering tasks alongside decreasing pure-ops work. That is not a problem; it is how durable, well-rounded engineers are built.

Key Takeaways

• The boundary between IT operations and IT engineering is not fixed — most roles blend both.
• Ops experience, especially in systems administration, provides a strong foundation for engineering work.
• Build engineering skills through lab practice, project involvement, and deliberate collaboration with engineering colleagues.
• Vendor certifications help, but demonstrated experience carries more weight with employers.
• Engineering professionals with operational awareness design more resilient, maintainable systems — making the ops-to-engineering path a genuine asset, not just a stepping stone.