NetSec Network Segmentation
Network segmentation divides a single network into smaller, isolated sections. Each section can communicate with other sections only through controlled, monitored pathways. If an attacker compromises a device in one segment, segmentation prevents them from freely reaching devices in other segments. It is one of the most effective techniques for limiting the damage a breach can cause.
The Flat Network Problem
FLAT NETWORK (no segmentation): All devices on the same network — 192.168.1.0/24 [CEO's Laptop] [Payroll Server] [Guest Wi-Fi User] [Factory Floor PC] [Web Server] [HR Database] [IP Camera] [Visitor's Phone] All devices can reach each other directly. An attacker who compromises the Guest Wi-Fi can directly probe and attack the Payroll Server. A ransomware infection on one PC spreads to all PCs in minutes.
Segmented Network Architecture
SEGMENTED NETWORK:
[ Core Router / Firewall ]
│
┌───────────┼───────────┬────────────┐
│ │ │ │
[VLAN 10] [VLAN 20] [VLAN 30] [VLAN 40]
Finance HR Operations Guest/IoT
Finance VLAN: Payroll Server, Finance PCs (192.168.10.0/24)
HR VLAN: HR Database, HR Workstations (192.168.20.0/24)
Operations VLAN: Factory systems, OT devices (192.168.30.0/24)
Guest/IoT VLAN: Wi-Fi guests, IP cameras, smart devices (192.168.40.0/24)
Cross-VLAN communication requires router/firewall approval.
Guest device cannot reach Finance VLAN directly. Period.
How Segmentation Limits Damage
Ransomware Containment
WITHOUT SEGMENTATION: Ransomware infects HR PC (192.168.1.50) → Scans entire 192.168.1.0/24 → Finds and encrypts 200 other devices in minutes → Organization-wide incident WITH SEGMENTATION: Ransomware infects HR PC (192.168.20.50) → Scans 192.168.20.0/24 (HR VLAN only) → Firewall blocks spread to Finance VLAN, Ops VLAN → Only HR devices affected → Finance and Operations continue normally during recovery
Lateral Movement Prevention
Attacker gains foothold via phishing on Marketing PC: Marketing VLAN (192.168.50.0/24) → Tries to reach Finance server (192.168.10.5) → Firewall rule: Marketing VLAN → Finance VLAN: DENY ALL → Cannot reach Finance → Tries to reach HR database (192.168.20.10) → Firewall rule: Marketing VLAN → HR VLAN: DENY ALL → Cannot reach HR either Attacker is contained to Marketing VLAN with limited damage potential.
Segmentation Techniques
VLANs (Virtual LANs)
VLANs create logical separation on the same physical switches. Traffic between VLANs must pass through a router or firewall where security rules are applied. VLANs are the most common segmentation mechanism in enterprise networks.
Physical Separation
Truly critical systems use completely separate physical network hardware — different switches, different cables, different firewalls. The most sensitive networks (like classified government networks or nuclear plant control systems) use "air gaps" — physically disconnected from any other network, including the internet.
Micro-Segmentation
Modern software-defined networks allow segmentation at the individual workload or VM level. Instead of all VMs in a data center sharing a VLAN, each VM has its own security policy that controls which other VMs it can communicate with — even within the same server chassis. This is a core component of Zero Trust architecture.
Segmentation Design Principles
Principle | Application ---------------------------------|---------------------------------------------- Group by risk level | High-risk systems isolated from low-risk Group by function | Finance, HR, Operations, IT in separate segments Least privilege between segments | Default deny; only explicitly needed flows allowed Internet-facing separate | DMZ for all systems accessible from outside IoT and OT isolated | Cameras, HVAC, manufacturing systems separate Third-party access separate | Vendor access segment, not corporate network Development separate from prod | Prevent dev mistakes from reaching prod systems
OT/ICS Network Segmentation
Operational Technology (OT) and Industrial Control Systems (ICS) — factory equipment, power grids, water treatment controls — require extreme segmentation. These systems run older operating systems that cannot be patched. A cyberattack on OT can cause physical damage, environmental harm, or loss of life.
OT/IT Segmentation Model (Purdue Model):
Level 4: Enterprise IT Network (email, ERP, internet)
|
[DMZ / Data Diode] ← one-way data flow only
|
Level 3: Operations Network (historian servers, reporting)
|
[Industrial Firewall]
|
Level 2: Control Network (SCADA, HMI workstations)
|
Level 1: Controllers (PLCs, RTUs)
|
Level 0: Physical Process (motors, valves, sensors)
A data diode allows data to flow upward from OT to IT (for reporting)
but physically prevents ANY data from flowing downward from IT to OT.
An attacker who compromises the IT network cannot reach OT systems.
Testing Segmentation
Segmentation that has never been tested is segmentation that may not work. Firewall rule misconfigurations, VLAN hopping vulnerabilities, and routing errors can create unintended paths between segments. Regular penetration testing and automated network access testing should verify that segments are truly isolated as intended.
Segmentation Test: From Finance VLAN: ping HR database (should fail) From Guest VLAN: connect to TCP port 445 on any corporate device (should fail) From Operations VLAN: connect to internet directly (should fail — goes through proxy) From any VLAN: connect to air-gapped OT network (should always fail) Test results document what is isolated and what is not. Any unexpected successful connection reveals a gap to fix.
Network segmentation is one of the few security controls that is effective against a wide range of attack types — ransomware, lateral movement, data exfiltration, and insider threats. Organizations that implement segmentation thoughtfully and verify it regularly consistently show smaller breach impact and faster recovery times than those operating on flat networks.