Network Segmentation
Network segmentation means dividing a computer network into multiple separate zones, between which only explicitly permitted traffic can flow. This way, an attacker who has broken into one zone remains trapped there and cannot immediately reach all other devices.
In a company, all computers, printers, and servers are connected to one another via a network. This means they can send each other data. Network segmentation means splitting this one large network into several smaller zones. Each zone is its own area, and between the zones a fixed rule applies: only what is explicitly permitted is allowed. The checkout computer in a store, for example, may talk to the payment server, but not to the surveillance camera in the warehouse. You can imagine it like a ship with bulkheads: a leak floods only one compartment, not the entire hull.
Why a break-in doesn’t have to cost you the whole house
Hardly any attack begins where the valuable data actually resides. Usually an employee clicks on a fake email, and the attacker initially ends up on some unimportant office computer. From there, they work their way forward, device by device. Experts call this movement through the network lateral movement. It is precisely this spread that segmentation is meant to stop.
In a flat network without dividing walls, this advance often succeeds within hours. If the network is properly segmented, the attacker hits a wall after just a few steps. They then have to overcome another hurdle, and in doing so they leave traces. Defenders gain time to notice the incident and shut down the affected area. In the best case, what could have been total damage becomes a contained incident.
There is also a practical reason: regulations require it. Anyone processing credit card data must demonstrably separate this part of the network from the rest. Hospitals and energy providers are likewise obligated to decouple their control technology from the normal office environment. Segmentation is therefore not just a technical measure but often simply a requirement.
From VLANs to microsegmentation
The classic method works with so-called VLANs. These are virtual networks that run on the same cabling but behave like separate networks. Every device gets a tag, and devices with different tags cannot see each other directly. If traffic wants to move from one zone to another, it has to pass through a firewall. This checks, based on rules, whether the connection is allowed, and discards it otherwise.
A finer-grained variant is called microsegmentation. Here, the boundary is no longer drawn around entire departments but around individual servers or individual programs. The rules then no longer depend on the cable or the address, but on the identity of the system. A web server may talk to exactly one database, and nothing else. This is the core idea of Zero Trust, in which even devices within one’s own premises are fundamentally considered untrustworthy.
The effort lies less in the technology than in the rules. You need to know which system really needs to talk to which other system. Anyone who locks things down too strictly risks accidentally disabling invoice printing or the phone system. That’s why many projects begin with a pure observation phase: traffic is logged for months, and only afterward are the blocks activated.
Guest network, factory floor, cloud data center
You may know the simplest form from home. Many routers offer a guest Wi-Fi network. Anyone who connects there gets internet access but cannot reach the family PC or the network drive. That is network segmentation in miniature. This is also useful for smart plugs and cameras, which often go years without receiving security updates.
In industry, machine control systems are strictly separated from the office network. When a pipeline in the US was crippled by ransomware in 2021, it was mainly the billing system that was affected. The operator nevertheless halted production because it wasn’t confident enough in the separation from the control systems. Such cases regularly appear in business news and explain why insurers now ask about segmentation.
The principle is also everyday practice at cloud providers. There, the systems of many customers run on the same hardware and are kept apart by virtual network boundaries. A common misconception is that segmentation replaces antivirus software or passwords. It does not. It only limits the damage when those other protective measures have failed.