Network segmentation
We split a flat corporate network into zones so that one infected device cannot reach the entire network.
When you need it
When one workstation can reach everything
In most organizations the internal network is flat: from a single workstation you can reach the servers, the backup system, the printers, and every other workstation. This causes no trouble for years, right up to the first incident.
The attack starts on the inside
A typical incident begins with phishing or a stolen password, so the attacker gets around the perimeter defenses. On a flat network, moving from the first compromised machine to the real target costs them very little.
The network decides how much damage is done
What matters is how many systems the attacker can reach from the first machine, how quickly they gain higher privileges, and whether they can get to the backups. All three depend on how the network is built, and endpoint protection does not help with that.
VLANs, but no boundary
A VLAN is a logical separation on a single physical infrastructure. If traffic is routed between VLANs without filtering, the segments can reach each other freely, so the zone boundary needs a decision point.
Zone model
What to separate first
The zone model records which system goes into which zone. Each of the four zones below can be separated on its own. Outbound traffic is part of the model too, because restricting it is what stops an attacker from setting up a command-and-control channel and from exfiltrating data.
Segmenting the internal network: where to startBackup infrastructure
If the backup server can be reached from the same segment as the workstations, ransomware deletes the backups first and encrypts afterwards. So backups go into a separate segment that accepts traffic only from the systems being backed up.
Domain controllers and identity
Domain controllers get their own segment with strictly defined inbound traffic. The certificate authority (ADCS), which is often left out, belongs here too. Administrative access is possible only through a jump server that is isolated as well.
Workstations isolated from each other
With client isolation, machines in the user segment cannot reach each other, only the servers and the internet egress. Most managed switches support it, and it is exactly what stops attacks that spread from machine to machine.
Unmanaged devices
Printers, IP cameras, access control systems, and building automation devices often run with default passwords and firmware that has never been updated. They go into their own segment with restricted outbound traffic, and their management interfaces can be reached only from the IT segment.
The process
How we split the network into zones
Many organizations are wary of segmentation because the first faulty rule breaks something, and from then on nobody is allowed to touch the network. That is why we schedule the rollout and plan it so that it does not disrupt operations.
-
Mapping
We document the current network and look at what talks to what. NetFlow or the firewall log is enough to collect the traffic. Traffic first, rules second: a rule written from the documentation alone will always have gaps.
-
Zone model and rules
We define the zones and design the traffic allowed between them. We follow the principle of least privilege: anything not explicitly allowed is denied.
-
Scheduled rollout
We roll out the zones and the rules between them on a schedule, so that the rollout does not disrupt operations.
-
Final test and handover
We check that the separated systems can be reached from other zones only in the ways the rules allow. We document the final zone model and rule set and hand them over.
Deliverables
What you get at the end
items handed over
- Documentation of the current network
- Zone model and rules between zones
- Scheduled rollout that does not disrupt operations
- Final test and documentation
Related services
What keeps the zone boundaries in place
The rules between zones are enforced by network devices. The services below build and check those devices.
Firewall and VPN
Design, installation, and configuration of next-generation firewalls, together with VPN for site-to-site and remote access.
Switching and routing
Design and build of the local network's switching and routing infrastructure, with redundancy and a VLAN structure.
Network access control (NAC)
Only known, compliant devices can connect to the network. Unknown devices are placed in an isolated zone.
Firewall configuration hardening audit
A review of the rule sets and settings of your existing firewalls against accepted security recommendations: unnecessary, overly broad, or outdated rules, and weak settings.
Frequently asked questions
The questions we hear most
How can I tell whether our network is flat?
With a quick self-test: sit down at an ordinary workstation and try to open the admin interface of the backup server. If the login screen appears, and it does surprisingly often, segmentation is missing.
Should we start with microsegmentation?
Usually not. Microsegmentation splits the network into zones at the application or workload level, with strictly defined traffic. It is the strongest barrier against attacks that spread from machine to machine, but it takes a lot of design work and delivers only a fraction of the benefit you get from separating a few well-chosen zones. It is better to start with the basic zones and go further later. In our Zero Trust guide, application-level segmentation is the third round.
Is this the right service for an industrial network too?
We have a separate service for OT environments. There we split the flat OT network into zones so that a compromised device cannot be used to spread across the whole plant. The zones and the conduits between them follow the IEC 62443 model. Details are on the OT network segmentation page.
What needs to happen after the rollout?
The rule set needs regular review. Most firewalls show how many times each rule has been hit, and rules with zero hits can be deleted. If nobody records why a line is in the rule set, no one dares to touch it later, and from then on it only grows. We also take on periodic rule set reviews as network maintenance, under a custom agreement and within a scope agreed with the client.
