as part of the provisioning process and is main- tained through an API-based orchestration to meet the changing need of the workload. A conceptual view of the microperimeter concept is depicted in Figure 9.19. These VM (work- load) 1 has "three security rings" of protection including URL, FW, and IDS. In Figure 9.20, work- load requires only two microperimeters including FW and IDS. Each of these have specific policy aligned to the workload based on the services each system is providing. These microperimeters are implemented as SFV objects. This differs from traditional security system as they are implemented, since SFV is implemented as "software only" and is attached to the workload using SDN techniques. This level of control provides protection for what was previously the "soft gooey center" of both cloud and physical iron enterprise environment. These protections close that soft center by provid- ing east-west protections between VM's that previously did not exist. Network Security Firewall Intrusion Protection URL Filtering FIGURE 9.19 Conceptual view of microperimeter on VM1 (three rings). To extend the security protection technologies beyond the individual workload objects, the ASTRA security construct also provides additional layers of protection through the provisioning and orchestration of tenant-level or project-level protections. A tenant can be thought of as a logical grouping of workload objects (VMs) into a workgroup cluster. This workgroup or logical tenant grouping is not bound by physical networking and can be geographically distributed. By provisioning and orchestrating a higher-level policy to the workgroup, an additional protec- tion ring is available to shield the entire tenant group. The workgroup perimeter works in conjunc- tion with the micro-perimeter protection while enabling alternative protection technologies and policies to be provisioned that protect the entire workgroup (Figure 9.21). The workgroup protection model extends the access controls directly applied to the individual work