In many networks that have grown over time, every device can reach every other: the office PC the server, the printer the production system, the guest smartphone the camera. In such a flat network, an attacker can move freely after the initial breach. Experts call this lateral movement. Malware such as ransomware exploits exactly this to encrypt as many systems as possible. Segmentation limits this damage and also creates transparency.
How does network segmentation work?
- Logical separation: Virtual networks (VLANs) are set up on the switches. Each segment gets its own IP address range.
- Controlled transitions: Traffic between segments passes through a firewall or a router with access lists. The basic rule is to block everything that is not explicitly allowed.
- Physical separation: For particularly critical areas, completely separate cabling can make sense.
- Microsegmentation: In virtualized environments and in the cloud, rules can be broken down to individual servers or applications, a core element of Zero Trust.
- Automatic assignment: With network access control based on IEEE 802.1X, devices automatically land in the appropriate segment after they authenticate.
Typical examples
Common segments in companies are:
- Workstations
- Servers and backup
- Management access for switches, firewalls, and hypervisors
- Guest Wi-Fi
- Printers, cameras, and other IoT devices
- Production and building technology, see OT security
- A DMZ for services reachable from the internet
What companies should keep in mind
- Map communication: Before creating rules, determine which systems actually need to talk to each other.
- Proceed step by step: First separate guests, IoT, and production, then divide servers and clients more finely.
- Protect backups in particular: Backup systems belong in their own, strictly isolated segment.
- Filter, do not just separate: VLANs without rules at the transitions provide little security gain.
- Maintain rules: Document firewall rules and regularly check them for outdated exceptions.
How it differs
Segmentation is no substitute for protection on the devices themselves. It does not prevent an initial breach, but it makes spreading harder and makes unusual traffic between segments visible. It achieves its full effect in combination with endpoint protection, monitoring, and regularly analyzed firewall logs.
View network expertise