{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/network-segmentation","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/network-segmentation/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/network-segmentation/"},"term":{"en":"Network segmentation","da":"Netværkssegmentering"},"aka":{"en":["segmentation"],"da":["segmentering"]},"domain":["cs","security"],"cluster":"networking","layer":"network","status":"current","summary":{"en":"Splitting one network into separate zones, so a problem in one zone cannot easily spread to the others.","da":"At dele ét netværk op i adskilte zoner, så et problem i én zone ikke let kan sprede sig til de andre."},"body":{"formal":{"en":"The practice of dividing a network into smaller parts, with routers or firewalls between them enforcing which traffic may cross from one part to another.","da":"Praksis med at dele et netværk op i mindre zoner, hvor routere eller firewalls imellem dem håndhæver, hvilken trafik der må krydse fra én del til en anden."},"plain":{"en":"Like the watertight compartments in a ship - if one fills with water, the doors between them keep the whole ship from sinking.","da":"Som de vandtætte rum i et skib - hvis ét fyldes med vand, forhindrer dørene imellem dem, at hele skibet synker."},"inPractice":{"en":"A hospital keeps its medical equipment, guest wifi and office laptops in separate zones, so a virus on a guest's phone cannot reach the scanners.","da":"Et hospital holder medicinsk udstyr, gæste-wifi og kontorets bærbare i hver sin zone, så en virus på en gæsts telefon ikke kan nå scannerne."},"whyItMatters":{"en":"Attackers who get in usually try to move sideways to more valuable systems; segmentation limits how far one break-in can go.","da":"Angribere, der kommer ind, prøver som regel at bevæge sig videre til mere værdifulde systemer; segmentering begrænser, hvor langt ét indbrud kan nå."}},"deepDive":{"en":"Segmentation can be implemented at several layers. The strongest form is physical separation, up to an air gap. The common form is logical: VLANs (IEEE 802.1Q, with a 12-bit VLAN ID giving 4,094 usable VLANs) split the switched network into broadcast domains, each mapped to its own IP subnet, and traffic between subnets is forced through a router ACL or, better, a firewall that enforces an explicit inter-zone policy. VRFs separate routing tables for larger designs. A VLAN on its own is not a security boundary: if the core switch routes freely between VLANs, the network is still flat at layer 3. Poorly configured trunks also allow VLAN hopping through switch spoofing (auto-negotiated trunking such as Cisco DTP) or double tagging via the native VLAN, which is why access ports are hard-coded and the native VLAN is left unused.\n\nMicrosegmentation moves enforcement down to the individual workload, using host firewalls, distributed firewalls in the hypervisor, Kubernetes NetworkPolicy, or identity-based tags instead of IP ranges. NIST SP 800-207 (2020) lists microsegmentation as one approach to Zero Trust architecture, but the two are not the same: segmentation limits which paths exist, while Zero Trust also authenticates and authorizes each request that uses a permitted path.\n\nSeveral reference models shape zone design. Internet-facing services live in a DMZ, separated both from the internet and from internal zones. In industrial environments the Purdue model and the IEC 62443 concept of zones and conduits separate enterprise IT from control systems, typically with an industrial DMZ in between. Under PCI DSS, segmentation is not mandatory, but it can reduce the scope of the cardholder data environment, provided penetration tests confirm that the segmentation actually isolates it. CIS Controls v8 Safeguard 12.2 requires a documented secure network architecture that addresses segmentation, least privilege and availability.\n\nSegmentation typically fails at the shared services. Domain controllers, backup servers, monitoring and management systems, jump hosts and dual-homed machines must reach many zones, and an attacker who compromises one of them, or obtains domain administrator credentials, can move through allowed protocols such as SMB, RDP and WinRM regardless of the zone model. NotPetya in 2017 showed how quickly malware spreads through flat, credential-shared Windows estates. Good practice is to start from an asset inventory and mapped data flows, define zones by sensitivity and trust, default-deny inter-zone traffic, put management interfaces and backups in their own restricted zones, monitor east-west traffic, and verify the rules by scanning from inside each zone rather than trusting the diagrams.","da":"Segmentering kan gennemføres på flere lag. Den stærkeste form er fysisk adskillelse, helt op til et air gap. Den almindelige form er logisk: VLAN'er (IEEE 802.1Q med et 12-bit VLAN-ID, der giver 4.094 brugbare VLAN'er) deler det switchede netværk op i broadcast-domæner, som hver svarer til sit eget IP-subnet, og trafik mellem subnet tvinges gennem en ACL på en router eller, bedre, en firewall, der håndhæver en eksplicit politik mellem zonerne. I større design adskiller VRF'er routingtabellerne. Et VLAN er ikke i sig selv en sikkerhedsgrænse: Hvis core-switchen frit router mellem VLAN'erne, er netværket stadig fladt på lag 3. Dårligt konfigurerede trunks giver også mulighed for VLAN hopping via switch spoofing (automatisk forhandlet trunking som Ciscos DTP) eller double tagging via native VLAN, og derfor låses access-porte fast, og native VLAN holdes ubrugt.\n\nMikrosegmentering flytter håndhævelsen ned til den enkelte arbejdsbelastning ved hjælp af værtsfirewalls, distribuerede firewalls i hypervisoren, Kubernetes NetworkPolicy eller identitetsbaserede mærker i stedet for IP-intervaller. NIST SP 800-207 (2020) nævner mikrosegmentering som én tilgang til Zero Trust-arkitektur, men de to er ikke det samme: Segmentering begrænser, hvilke veje der findes, mens Zero Trust også autentificerer og autoriserer hver anmodning, der bruger en tilladt vej.\n\nEn række referencemodeller former designet af zoner. Tjenester, der vender mod internettet, placeres i en DMZ, adskilt både fra internettet og fra de interne zoner. I industrielle miljøer adskiller Purdue-modellen og IEC 62443's begreb om zoner og conduits virksomhedens IT fra styresystemerne, typisk med en industriel DMZ imellem. Under PCI DSS er segmentering ikke obligatorisk, men den kan indskrænke omfanget af kortdatamiljøet, forudsat at penetrationstest bekræfter, at segmenteringen faktisk isolerer det. CIS Controls v8, safeguard 12.2, kræver en dokumenteret sikker netværksarkitektur, der adresserer segmentering, mindste privilegium og tilgængelighed.\n\nSegmentering fejler typisk ved de fælles tjenester. Domænecontrollere, backupservere, overvågnings- og administrationssystemer, jump hosts og maskiner med ben i flere netværk skal kunne nå mange zoner, og en angriber, der kompromitterer én af dem eller får fat i domæneadministrator-legitimationsoplysninger, kan bevæge sig via tilladte protokoller som SMB, RDP og WinRM uanset zonemodellen. NotPetya viste i 2017, hvor hurtigt malware spreder sig i flade Windows-miljøer med delte legitimationsoplysninger. God praksis er at tage udgangspunkt i en aktivoversigt og kortlagte dataflows, definere zoner efter følsomhed og tillid, afvise trafik mellem zoner som standard, lægge administrationsgrænseflader og backup i egne, begrænsede zoner, overvåge øst-vest-trafik og efterprøve reglerne ved at scanne indefra i hver zone i stedet for at stole på tegningerne."},"edges":[{"type":"requires","to":"cs/network","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/router","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/firewall","confidence":"high","strength":"normal"},{"type":"implements","to":"cs/least-privilege","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/ransomware","why":{"en":"Walls between zones stop ransomware from spreading from one infected machine to the whole company.","da":"Vægge mellem zoner forhindrer ransomware i at sprede sig fra én inficeret maskine til hele virksomheden."},"confidence":"high","strength":"primary"},{"type":"mitigates","to":"security/data-breach","why":{"en":"Keeping sensitive data in its own zone means a break-in elsewhere does not automatically reach it.","da":"Når følsomme data ligger i deres egen zone, når et indbrud andre steder ikke automatisk frem til dem."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/zero-trust","confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"Tanenbaum, Computer Networks","tier":"textbook"},{"title":"CIS Controls v8 - Control 12, Network Infrastructure Management","tier":"standard"}],"draft":true}