What Is Network Segmentation?

Segmentation divides a network into zones with controlled crossings between them, so that reaching one part does not imply reaching the rest. It is the single most effective control against lateral movement, and flat networks remain the most consistent serious finding in internal assessments.

This entry covers coarse-grained zoning. Per-workload policy is covered in micro-segmentation.

Why flat networks persist

Not ignorance — difficulty. Segmenting an existing production network risks breaking applications whose communication requirements nobody fully documented, and the person who implements it owns any outage that follows.

The result is that segmentation is agreed in principle, scheduled, and deferred. Meanwhile every new system is connected to the same flat network because that is what exists.

A sequence that actually completes

The permissive monitoring step is what makes this safe. It reveals the legitimate traffic nobody documented — the backup agent, the monitoring poller, the integration built years ago — before anything is blocked.

Where the boundaries belong

Start with what an attacker would want and what would hurt most: databases holding regulated data, domain controllers and management interfaces, backup infrastructure, and any operational or clinical technology. Separating user networks from server networks is usually the highest-value first boundary.

Segmentation has to survive the next project

The common pattern is a segmentation programme that completes, followed by eighteen months of exceptions that quietly restore reachability. Each is justified individually and the cumulative effect is a flat network with extra firewall rules.

Preventing that is governance rather than technology. New systems need a defined zone rather than being placed wherever is convenient. Cross-zone requests need an owner, a reason and ideally an expiry. And periodic review should ask whether the boundaries still hold.

Without that, segmentation is a project with a decay curve rather than an architecture.

Documentation of intent is what makes boundaries maintainable. A rule permitting traffic between two zones, with no record of which application required it, cannot be safely removed by anyone later — so it stays, indefinitely. Recording the requesting system and owner at the moment the exception is granted costs almost nothing and is the difference between a reviewable boundary and a permanent one.

A common mistake worth avoiding

Whatever else is on the list, the answer worth establishing first is whether backup infrastructure is reachable from an ordinary workstation. It is a question that can be settled in a day, it requires no procurement, and the answer determines whether the rest of the programme is addressing the largest exposure or a smaller one that happened to be easier to see.

Where to start

Check whether your backup infrastructure is reachable from a standard user workstation. If it is, that boundary is worth more than any other segmentation work you could do this year.

See starting small with segmentation. GuardsArm runs security program reviews.