Network Segmentation

Network segmentation is the practice of dividing a network into isolated zones with controlled, monitored paths between them, so that compromising one system does not grant access to all of them. A flat network is a single room: one phished employee, one infected laptop, and the attacker can see every server, share, and backup. A segmented network is a series of locked doors, each one a chance to stop, slow, or detect the intruder.

How it works

Segments are defined by business function and sensitivity — user workstations, servers, finance systems, backups, building systems — and enforced with VLANs, firewalls, and access policies that specify which zones may talk to which, on which ports, as which identities. Microsegmentation pushes the idea to its limit, applying per-workload rules so that even machines in the same zone cannot reach each other without explicit permission; this is a core building block of zero trust architecture. The payoff shows in incidents that begin, as most now do, with a person: a ransomware operator who phishes a workstation in a well-segmented network faces days of additional work to reach domain controllers and backups, and every blocked or logged crossing is a detection opportunity. Since lateral movement appears in roughly three-quarters of ransomware cases, the interior of the network is where these attacks are won or lost — a theme we unpack in our analysis of how ransomware starts.

How to defend with it

Segment by blast radius: ask what an attacker holding one zone could reach, and put the crown jewels — backups, identity infrastructure, finance, production data — behind their own boundaries with MFA and least privilege on every crossing. Deny by default between zones and log what the policy blocks; those logs are early warning. Keep management interfaces and backup credentials out of the general user network entirely. And test the assumption, not the diagram: a penetration test or tabletop that starts from one compromised workstation shows whether your segments contain an intruder in practice or only in the architecture slide.