Network Segmentation
Network segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is to limit an attacker's ability to move through the network after compromising a single system.
Term
description · examples · notesNetwork segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is to limit an attacker's ability to move through the network after compromising a single system.
Description
Segmentation is implemented through VLANs, firewalls, router access control lists, and software-defined network policies. Critical systems are separated from less sensitive ones, and access is permitted only as needed.
Good segmentation significantly slows lateral movement and provides more opportunities for detecting compromise before the attacker reaches the most valuable resources.
What people often say
- Splitting the network into two segments (internal and DMZ) is sufficient.
- Segmentation replaces the need for patching systems within a segment.
Covers / does not cover
Covers
- Limiting attacker lateral movement within the network
- Isolating critical systems from less sensitive segments
- Reducing the scope of damage when one segment is compromised
- Controlling network traffic between segments
Does not cover
- Attacks occurring within a single segment
- Threat detection (segmentation constrains, it does not detect)
- Protection against application-layer attacks using permitted communication paths
Mentioned in the news
Threats
reduces 17Threats it reduces. Select one to open its page.