Stop 02 · Networking Fundamentals for SecurityTopics · 8/10

Network Segmentation

In short

In a flat network, one infected laptop can reach every server. Segmentation splits the network into zones so a breach stays small. It's one of the best-value defences there is.

Dividing a network into isolated zones so a breach in one segment can't easily spread to others — one of the highest-impact defensive architecture decisions an organization can make.

The blob bails water out of one flooded section of a small boat.

Think of it like this

A boat with sealed compartments

Big ships are built with watertight sections. If the hull cracks in one place, only that section floods and the ship stays afloat. Segmented networks work the same way: one zone gets hit, the rest stay dry.

Watch it happen

Malware tries to spread across zones

Staff laptop

Internal FW

Database zone

Staff printer

infected by phishing

1/5A staff laptop gets malware from an email attachment.

The big ideas

What you need to know

Zones by trust and job

Common zones: users, servers, databases, guests, cameras and IoT, and a DMZ for public-facing servers.

Control traffic between zones

Firewalls or ACLs at zone boundaries allow only the flows each zone really needs.

VLANs and subnets

Segments are usually built with VLANs on switches and separate subnets, then filtered by firewalls.

Micro-segmentation

In data centres and cloud, rules can go down to individual workloads, not just whole zones.

Save yourself the pain

Common mistakes

Oops

Segmenting the network but allowing 'any to any' between zones.

Do this instead

A segment without rules is just a label. Write allow rules for the flows needed and deny the rest.

Oops

Putting smart TVs and CCTV cameras on the main staff network.

Do this instead

IoT devices are often poorly patched. Give them their own zone with no route to important servers.

Your mission

Draw a segmented network

~25 min

Quick check

Why is a flat network risky?

Go deeper

1Diagram a segmented network design for a hypothetical organization (e.g. isolating guest Wi-Fi from internal systems).
2Learn why flat, unsegmented networks make lateral movement trivial for an attacker.
3Understand the concept of a DMZ (demilitarized zone) for public-facing services.