Network segmentation

Segmentation can be implemented at several layers. The strongest form is physical separation, up to an air gap. The common form is logical: VLANs (IEEE 802.1Q, with a 12-bit VLAN ID giving 4,094 usable VLANs) split the switched network into broadcast domains, each mapped to its own IP subnet, and traffic between subnets is forced through a router ACL or, better, a firewall that enforces an explicit inter-zone policy. VRFs separate routing tables for larger designs. A VLAN on its own is not a security boundary: if the core switch routes freely between VLANs, the network is still flat at layer 3. Poorly configured trunks also allow VLAN hopping through switch spoofing (auto-negotiated trunking such as Cisco DTP) or double tagging via the native VLAN, which is why access ports are hard-coded and the native VLAN is left unused.

Microsegmentation moves enforcement down to the individual workload, using host firewalls, distributed firewalls in the hypervisor, Kubernetes NetworkPolicy, or identity-based tags instead of IP ranges. NIST SP 800-207 (2020) lists microsegmentation as one approach to Zero Trust architecture, but the two are not the same: segmentation limits which paths exist, while Zero Trust also authenticates and authorizes each request that uses a permitted path.

Several reference models shape zone design. Internet-facing services live in a DMZ, separated both from the internet and from internal zones. In industrial environments the Purdue model and the IEC 62443 concept of zones and conduits separate enterprise IT from control systems, typically with an industrial DMZ in between. Under PCI DSS, segmentation is not mandatory, but it can reduce the scope of the cardholder data environment, provided penetration tests confirm that the segmentation actually isolates it. CIS Controls v8 Safeguard 12.2 requires a documented secure network architecture that addresses segmentation, least privilege and availability.

Segmentation typically fails at the shared services. Domain controllers, backup servers, monitoring and management systems, jump hosts and dual-homed machines must reach many zones, and an attacker who compromises one of them, or obtains domain administrator credentials, can move through allowed protocols such as SMB, RDP and WinRM regardless of the zone model. NotPetya in 2017 showed how quickly malware spreads through flat, credential-shared Windows estates. Good practice is to start from an asset inventory and mapped data flows, define zones by sensitivity and trust, default-deny inter-zone traffic, put management interfaces and backups in their own restricted zones, monitor east-west traffic, and verify the rules by scanning from inside each zone rather than trusting the diagrams.