🔀 Network Segmentation
Dividing a network so one breach doesn't compromise everything⏱ ~2 min
The Titanic had watertight compartments designed to contain flooding. When multiple compartments flooded simultaneously, the ship sank — the design failed because the compartments weren't truly isolated. Network segmentation works the same way: divide the network so that a breach in one segment (say, the guest WiFi) cannot spread to critical systems (the payment servers or hospital records). When segmentation is done right, lateral movement is stopped.
The Broadcast Domain Problem
In a flat network (everything on one subnet), every device can communicate with every other device. This creates two problems: (1) performance — broadcast traffic from one device goes to every device; (2) security — malware or an attacker on one device has direct access to every other device with no barriers. Segmentation solves both.
Segmentation Techniques
| Technique | How It Works | Use Case |
|---|---|---|
| VLANs (Virtual LANs) | Logically divide a single physical network into isolated segments at Layer 2; traffic between VLANs must go through a router/firewall | Separate Finance, HR, Guest, IoT, and Security cameras onto different VLANs on the same physical switches |
| Subnetting | Divide IP address space into smaller networks; routers control inter-subnet communication | Give each department its own subnet (192.168.1.0/24 for Finance, 192.168.2.0/24 for Marketing) |
| DMZ (Demilitarized Zone) | Network segment between the internet and internal network for public-facing servers | Web servers, email servers, public APIs — accessible from internet but isolated from internal network |
| Air Gap | Complete physical separation — no network connection between segments at all | Critical infrastructure (power grid controls), classified government networks, nuclear facility controls |
| Micro-segmentation | Software-defined networking creates very fine-grained policies between individual workloads | Cloud environments; zero-trust architectures where even internal east-west traffic is controlled |
Why Segmentation is a Core Defense-in-Depth Control
- •Limits lateral movement — after breaching one device, an attacker cannot freely reach other segments
- •Contains malware — ransomware spreading via network shares is stopped at segment boundaries
- •Isolates IoT/OT devices — smart TVs, HVAC systems, printers are notoriously insecure; segment them from critical systems
- •Regulatory compliance — PCI-DSS requires card processing systems to be isolated from other networks
- •Reduces attack surface — a compromised guest WiFi device cannot scan or reach internal servers
- •Enables zero-trust — segmentation is the physical/logical enforcement mechanism for 'never trust, always verify'
A hospital has one flat network. A ransomware infection starts on a nurse's workstation after she opens a phishing attachment. Within 4 hours, the ransomware has spread to billing computers, the patient records database, and medical device controllers. If the hospital had implemented proper network segmentation, what would most likely have happened differently?