Network Segmentation
Network segmentation means breaking down a computer network into several separated areas, between which only selected connections are permitted. This prevents an attacker or malicious software from spreading unhindered throughout the entire network.
In a company, usually hundreds of devices are connected to one another: laptops, printers, point-of-sale systems, machines in production. This connection is called a network. Without further measures, every device within it can reach every other device. Network segmentation means breaking this network down into several separate areas. Between the areas, only what has been explicitly authorized is permitted. The model is the bulkheads in a ship: if one compartment fills with water, the entire ship does not immediately sink as a result.
What an attacker can do in a flat network
Most attacks begin at an unspectacular point. Someone opens an email attachment, an old device has a known security vulnerability, a password was too weak. The first infected computer is rarely the actual target. Things only get interesting for attackers once they can move on from there. Experts call this lateral movement, meaning sideways advancement through the network.
This is exactly where segmentation comes in. If the infected laptop is in its own separate area, the attack often ends after just a few steps. The attacker simply sees no further targets. Without segmentation, however, everything lies open: accounting, data backups, machine control systems. Major extortion attacks using encryption software often cause so much damage precisely because the network was built flat.
A second reason is of a legal nature. Anyone processing health data or payment data must demonstrate that this data is especially protected. A separated network area is a recognized means for this. The European NIS2 directive, too, which lays down security obligations for important companies, expects such separations.
From VLANs to microsegmentation
The classic method is called VLAN, short for virtual local area network. In this approach, network devices use software to split traffic into several logical networks, even though the same physical cables are being used. A device in the guest VLAN then cannot communicate directly with a server in the administration VLAN. At the transition points sits a firewall, a filter that allows or blocks data packets according to fixed rules.
How finely one separates things is a decision with consequences. Typical areas include ones for office computers, for servers, for guest Wi-Fi, and for production facilities. Those who go even further give each individual server, or even each individual application, its own rules. This is called microsegmentation. It is very effective but laborious to maintain, since every new application requires new authorizations.
A common misconception is that segmentation is a one-time project. In practice, it is ongoing work. Over the years, exception rules accumulate because something wasn’t working at some point. In the end, the network is formally segmented but practically permeable again. This is why security teams regularly check which connections are actually still needed.
Where the principle shows up in everyday life
There is a simple form of this at home, too. Many routers offer a guest Wi-Fi network. Anyone who logs in there gets internet access but cannot see the family’s network drive or printer. Some people also set up a separate network for connected devices such as cameras or lights, since their software is often poorly maintained.
In the news, the term usually appears following cyberattacks on hospitals, city administrations, or industrial companies. Reports then state that the network was inadequately segmented. The separation of office IT and production control systems, referred to as OT, is particularly sensitive. Old machine control systems often cannot be updated and only survive because they are isolated.
Related to this is the concept of Zero Trust, roughly meaning: trust no one on the network blindly. There, every system re-verifies who is requesting access on every single access attempt. Network segmentation is one building block of this but does not replace it. For investors, the term is relevant because providers of firewalls and network technology earn their money precisely with this.