What is network segmentation?
Network segmentation divides a network into smaller, isolated zones. This limits access and helps stop threats from spreading.
Each zone has its own security controls. These controls limit traffic between zones. They do not let traffic flow freely. The goal is simple: if someone compromises one part of the network, the damage stays contained and does not spread.
Why does segmentation matter?
- Stops lateral movement: Attackers who breach one area try to move sideways to reach more valuable systems. Segmentation makes that movement much harder, and most successful breaches involve some lateral movement.
- Protects sensitive systems: Critical assets such as databases and payment systems can be kept in their own zone, separate from general user traffic.
- Limits the blast radius: A breach or malware outbreak is confined to a single segment rather than the entire network.
How is segmentation done?
- Macro-segmentation: Traditional, coarse-grained separation into large zones, usually using VLANs, subnets, and internal firewalls.
- Microsegmentation: A finer-grained, identity-based approach that isolates individual workloads or applications, often without re-architecting the network.
- Common dividing lines: Separating a DMZ, corporate network, guest Wi-Fi, IoT or OT devices, and sensitive data environments.
How does it relate to zero trust?
- A foundational control: Segmentation is one of the core pillars of a zero trust architecture under frameworks like NIST SP 800-207.
- Microsegmentation makes zero trust real: It enforces least-privilege access between workloads, turning zero trust from a paper policy into something operational.
What about compliance?
Standards such as PCI DSS, HIPAA, and NIST 800-171 expect segmentation to isolate and protect regulated data, and it provides an audit trail that helps prove compliance.
