# What Is Network Segmentation? VLAN, Micro-Segmentation and Lateral Movement

**URL:** https://securesys.com.tr/en/learning/network-security/what-is-network-segmentation-vlan-micro

![What Is Network Segmentation? VLAN, Micro-Segmentation and Lateral Movement](/images/bilgi-merkezi/covers/cover-network-03.webp)

One of the most critical questions that must be asked when evaluating an organization's network security is this:

#### If an attacker compromises a single user computer, how far can they progress inside the network?

If from the user computer;

the servers,

the databases,

the backup systems,

the management interfaces of the network devices,

the Active Directory infrastructure,

the virtualization environment

and other critical systems can be reached directly, there may be a serious network architecture problem.

At the centre of this problem there is most often:

#### Flat Network

this structure.

A flat network describes a network structure in which sufficient security boundaries have not been created between systems or in which network access is broader than necessary.

In modern attacks the attackers' target is most often not the first device compromised.

The first system is only the entry point.

The attacker may then try to discover other systems inside the network and to progress towards critical resources.

This movement is called:

#### Lateral Movement

as it is known.

This is exactly one of the fundamental aims of Network Segmentation:

**To prevent the attacker from being able to move freely inside the network or to make it significantly more difficult.**

In modern corporate networks Network Segmentation;

VLAN,

ACL,

Firewall,

Security Zone,

VRF,

Internal Segmentation Firewall,

Micro-Segmentation,

NAC

and Zero Trust

can be applied using many technologies and approaches such as these.

However, there is an important distinction:

**Dividing the network and separating the network into segments securely are not the same thing.**

### What Is Network Segmentation?

Network Segmentation is the separation of the corporate network infrastructure into different network segments according to security, business function, system criticality or access need.

The aim is to prevent systems with different trust levels from communicating with one another in an uncontrolled way.

For example:

User Network

Server Network

Database Network

Management Network

Backup Network

Guest Network

IoT Network

OT Network

different segments such as these can be created.

### Why Is Network Segmentation Necessary?

Every system on a network does not need to communicate with all the other systems.

For example:

An accounting user does not need to reach the management port of the backup server.

A printer does not need broad network access to the domain controller.

A guest Wi-Fi user should not reach the corporate server network.

A web server does not need to reach the whole database network.

For this reason network access:

#### Need-to-Communicate

must be limited by this principle.

### What Is Need-to-Communicate?

It is permitting systems to communicate only with the systems they really need in order to carry out their functions.

This approach can be thought of as the network-level equivalent of the Least Privilege principle.

### What Is Network Least Privilege?

It is a system being able to communicate only over the necessary:

Source

Destination

Protocol

Port

Application

these.

For example:

Application Server

→

PostgreSQL Server

→

TCP/5432

Allow

However:

Application Server

→

Database Network

→

Any

Allow

can be broader than necessary.

### What Is a Flat Network?

A flat network is the network architecture in which network segmentation and access control are limited.

In such structures a large number of endpoints and servers can be located in the same broad network area.

### Why Is a Flat Network Risky?

When one endpoint is compromised the attacker may encounter fewer network security controls in reaching the other systems.

This situation;

Reconnaissance

Scanning

Credential Attack

Lateral Movement

Data Exfiltration

can make attack stages such as these easier.

### An Example of a Flat Network

If in an organization:

User PC

Printer

Server

Database

Backup Server

IP Camera

are located on the same network, the attack surface can grow seriously.

### What Are the Fundamental Security Goals of Network Segmentation?

The fundamental goals of Network Segmentation:

- To reduce the attack surface
- To limit lateral movement
- To shrink the blast radius
- To isolate critical assets
- To provide network visibility
- To apply access control
- To make incident containment easier
- To support compliance requirements

can be summarized in this way.

### What Is Attack Surface Reduction?

Attack surface reduction is the approach of reducing the number of systems and services the attacker can reach.

Network Segmentation is one of the most important methods for this.

### What Is Lateral Movement?

Lateral movement is the attacker's progress from a system they have compromised towards the other systems inside the network.

### How Does Lateral Movement Take Place?

After the attacker reaches the first system:

Network Discovery

↓

Host Discovery

↓

Service Discovery

↓

Credential Access

↓

Remote Access

↓

Lateral Movement

they can progress in this way.

### What Is Network Discovery?

It is the identification of the other devices and services inside the network.

### What Is Host Discovery?

It is the detection of the active systems.

### What Is Service Discovery?

It is the identification of the network services running on the systems.

### Does Segmentation Prevent Network Discovery?

It may not prevent it completely but it can seriously limit the network area the attacker can see.

### What Is Blast Radius?

The blast radius expresses the total scope of the systems a security incident can affect.

### How Does Network Segmentation Reduce the Blast Radius?

It can confine the compromised system inside a certain segment.

For example:

Compromised User PC

↓

User VLAN

X

Database VLAN

X

Backup VLAN

X

Management VLAN

In this case it becomes difficult for the attacker to reach critical systems directly.

### What Is Breach Containment?

It is the limiting of the spread of a security breach to other systems.

Network Segmentation is a critical control for incident containment.

### What Is a VLAN?

VLAN:

#### Virtual Local Area Network

is the technology that makes it possible to create logical network segments on top of the physical switch infrastructure.

### What Does a VLAN Do?

It can separate the devices on the same physical switch into different logical networks.

### A VLAN Example

VLAN 10 → Users

VLAN 20 → Servers

VLAN 30 → Databases

VLAN 40 → Management

VLAN 50 → Backup

VLAN 60 → Guest

### Is a VLAN a Security Control?

A VLAN is a powerful tool for segmentation.

However:

**Creating a VLAN does not provide security on its own.**

### Why Is a VLAN Not Enough on Its Own?

Because routing can be performed between different VLANs.

If the routing is uncontrolled the segments can reach one another.

### What Is Inter-VLAN Routing?

It is the provision of network communication between different VLANs through routing.

### Where Can Inter-VLAN Routing Be Performed?

Layer 3 Switch

Router

Firewall

it can be performed on these.

### Should Inter-VLAN Traffic Pass Through the Firewall?

Applying inspection and access control through a firewall on critical security segments is a strong approach.

### Can a Layer 3 Switch ACL Be Enough?

For some network needs an ACL can be enough.

However, when application awareness, threat detection or advanced logging is required a firewall can provide stronger control.

### What Is an ACL?

ACL:

#### Access Control List

is the rule list that controls network traffic according to source, destination, protocol and port information.

### An ACL Example

User VLAN

→

Database VLAN

→

DENY

Application VLAN

→

Database VLAN TCP/5432

→

ALLOW

### What Is the Difference Between an ACL and a Firewall?

An ACL generally provides basic Layer 3/Layer 4 filtering.

A firewall, on the other hand, can provide more advanced capabilities such as stateful inspection, application control, logging and threat prevention.

### What Is a Security Zone?

A security zone is the grouping of network segments with a similar security level in a logical security area.

### Example Security Zones

Untrust

DMZ

User

Server

Database

Management

Backup

Guest

OT

### What Is a Zone-Based Policy?

It is the definition of firewall policy through the source and destination security zone.

### What Is the Advantage of Using Security Zones?

It makes the network security policy more understandable and manageable.

### What Is a DMZ?

DMZ:

#### Demilitarized Zone

is the security segment in which internet-facing systems are separated from the internal network.

### Which Systems Can Be Located in the DMZ?

Reverse Proxy

Web Server

Mail Gateway

VPN Gateway

services open to external access such as these can be located there.

### Should a System in the DMZ Receive Full Access to the Internal Network?

No.

Only the necessary destinations and ports must be permitted.

### What Happens If the DMZ Is Compromised?

If there is correct segmentation it becomes more difficult for the attacker to pass to the internal network.

### What Is Server Segmentation?

It is the separation of servers from the user and other network areas.

### Should All Servers Be in the Same Segment?

Not always.

More detailed segmentation can be performed according to criticality and communication need.

### What Is Application Tier Segmentation?

It is the keeping of the different layers of the application in separate network segments.

For example:

Web Tier

↓

Application Tier

↓

Database Tier

### Why Is a Three-Tier Architecture Useful in Terms of Security?

Different access control can be applied between each application layer.

### Should the Web Server Reach the Database Directly?

It depends on the architecture.

In many designs the web tier communicates only with the application tier.

### What Is Database Segmentation?

It is the keeping of database systems in separate segments with a higher security level.

### Who Should Be Able to Reach the Database Network?

Only the necessary;

Application Server

DBA Management System

Backup System

Monitoring System

sources such as these.

### Should User Computers Reach the Database Network?

Generally direct access must be kept at a minimum level.

### Should Database Ports Be Open to the Whole Network?

No.

### What Is Backup Network Segmentation?

It is the separation of the backup infrastructure from the production and user networks.

### Why Should the Backup Network Be Separated?

In ransomware attacks the attackers may target the backup systems.

### Should the Backup Server Be Reachable From the User Network?

It must be limited as far as possible.

### How Should the Backup Management Interface Be Protected?

Dedicated Management Network

MFA

PAM

Firewall

controls such as these can be used.

### What Is the Management Network?

It is the special network segment in which the management interfaces of firewalls, switches, routers, hypervisors and servers are located.

### Why Is the Management Network Critical?

These interfaces provide highly privileged control.

### Should the Management Network Be Reachable From the User VLAN?

As far as possible, no.

### What Is a Dedicated Management VLAN?

It is the VLAN reserved for management traffic.

### What Is Out-of-Band Management?

It is a management infrastructure independent of the production network.

### Why Is Out-of-Band Management Powerful?

Even if a production network problem occurs the devices can be reached through a separate management path.

### What Is a Jump Server?

It is the controlled intermediate system administrators use in order to reach critical systems.

### What Is a Bastion Host?

It is the hardened system through which management access to sensitive networks or systems is carried out in a controlled way.

### Can PAM and Network Segmentation Be Used Together?

Yes.

The administrator:

User Network

↓

PAM / Bastion

↓

Management Network

↓

Critical System

can reach it in this controlled way.

### What Is a Guest Network?

It is the separate network created for the internet access of guest users.

### Should the Guest Network Reach the Corporate Network?

No.

### What Is Guest Wi-Fi Isolation?

It is the blocking of guest devices' access to the corporate network and, where necessary, to one another.

### What Is IoT Segmentation?

It is the keeping of IoT devices in a separate network segment.

### Why Should IoT Devices Be Separated?

Firmware support may be limited.

Default credentials may be present.

A security agent may not be installable.

### Can the Printer Network Be Separated?

Yes.

Shared devices such as printers can be kept in separate segments.

### Should the Camera Network Be Separated?

IP camera and NVR systems can be kept in a separate segment on a risk basis.

### What Is a Voice VLAN?

It is the carrying of IP telephone traffic on a separate VLAN.

### Is Segmentation Useful for VoIP Security?

Yes.

It can separate voice systems from user traffic.

### What Is OT Network Segmentation?

It is the separation of Operational Technology systems from the IT network with security boundaries.

### Why Is IT/OT Segmentation Critical?

It can reduce the spread of malware or a compromise on the IT network to the production environment.

### What Is an OT DMZ?

It is the intermediate security zone that provides controlled communication between the IT and OT environments.

### What Is the Purdue Model?

It is one of the layered reference models widely used for Industrial Control Systems and OT network architecture.

### Should There Be Direct Access From IT to the PLC?

In critical OT environments direct and broad access can create serious risk.

### What Is an Industrial Firewall?

They are the firewall solutions that support OT/ICS protocols and industrial network requirements.

### What Is Cloud Network Segmentation?

It is the separation of the workloads and services in the cloud environment into different network security boundaries.

### Are There VLANs in the Cloud?

Different network abstractions are used according to the cloud provider.

For example:

VPC

VNet

Subnet

Security Group

Network ACL

### What Is a VPC?

A Virtual Private Cloud is the logically isolated network environment inside the cloud.

### What Is a Subnet?

It is the network sub-section inside the VPC/VNet.

### What Is a Security Group?

It is the network access control mechanism applied to cloud workloads.

### What Is a Cloud Network ACL?

It is the control that can provide network filtering at subnet level.

### Are Cloud Segmentation and On-Premises Segmentation the Same?

The basic principle is the same:

**Block unnecessary communication.**

However, the technologies applied are different.

### What Is Hybrid Cloud Segmentation?

It is the management of on-premises and cloud networks together with their security boundaries.

### Can Cloud Peering Be Risky?

An incorrect configuration can create broad network access.

### What Is Transit Gateway Security?

It is the control of the central routing between more than one cloud network with security policies.

### What Is Micro-Segmentation?

Micro-segmentation is the more granular application of network segmentation at workload or application level.

### What Is the Difference Between Traditional Segmentation and Micro-Segmentation?

Traditional segmentation:

At network / VLAN level.

Micro-segmentation:

At workload / application level.

### A Micro-Segmentation Example

Inside the same Server VLAN:

Server A

→

Server B

Allow

Server A

→

Server C

Deny

policy can be applied in this way.

### Why Is Micro-Segmentation Necessary?

It prevents the systems inside the same VLAN from reaching one another without limit.

### Why Is Same-VLAN Traffic Important?

In the traditional firewall architecture the traffic inside the same VLAN may not pass through the firewall.

This situation can create an East-West visibility gap.

### What Is East-West Traffic?

It is the network traffic between internal workloads.

### Why Is East-West Traffic Critical?

In modern data center and cloud environments an important part of the traffic volume can take place between internal systems.

### What Is East-West Visibility?

It is being able to see how internal systems communicate with one another.

### How Is East-West Traffic Controlled?

Internal Segmentation Firewall

Distributed Firewall

Host-Based Firewall

Micro-Segmentation

technologies such as these can be used.

### What Is a Distributed Firewall?

It is the application of security policy in a distributed way at a point close to the workload.

### What Is a Host-Based Firewall?

It is the local firewall running on the endpoint or server.

### Can a Host-Based Firewall Be Used for Micro-Segmentation?

Yes.

With central policy management it can provide granular access control.

### What Is Software-Defined Segmentation?

It is the application of network segmentation through software-defined policy.

### What Is SDN?

SDN:

#### Software-Defined Networking

is the architectural approach that allows the network control plane to be managed centrally or programmatically.

### Is Micro-Segmentation Part of Zero Trust?

Yes.

It is an important control within the Zero Trust Architecture.

### What Is Zero Trust Segmentation?

It is the making of access decisions through identity, workload and context instead of network location.

### **Why Did the "Inside = Trusted" Approach Change?**

Because of cloud, remote work and modern attacks, being inside the network is no longer an indicator of trust.

### What Does Never Trust, Always Verify Mean?

It is the Zero Trust principle expressing that every access request must be verified.

### Are Zero Trust Network Access and Segmentation the Same?

No.

ZTNA can focus on user-to-application access.

Micro-segmentation can limit workload-to-workload communication.

### What Is Identity-Based Segmentation?

It is the application of network policy according to user or device identity instead of IP.

### What Is Device-Based Segmentation?

It is the determination of network access according to device type or security posture.

### How Is NAC Used in Segmentation?

NAC, by determining the device's;

identity,

type,

user,

security posture

can assign the appropriate VLAN or policy.

### What Is Dynamic VLAN Assignment?

It is the automatic assignment of a VLAN according to user or device characteristics.

### What Is a Quarantine VLAN?

It is the segment in which devices that do not meet the security conditions are isolated.

### What Is Adaptive Network Segmentation?

It is the dynamic changing of the access policy as the risk or context changes.

### Network Segmentation and Ransomware

Ransomware attacks may not stop at encrypting only the first endpoint.

The attackers may try to spread to other systems over the network.

For this reason segmentation is important in terms of ransomware resilience.

### How Is Ransomware Lateral Movement Limited?

For example:

User-to-User SMB restriction

User-to-Server restriction

Backup Network Isolation

Management Network Isolation

controls such as these can be used.

### Why Is SMB Segmentation Important?

SMB is used for file sharing and some Windows services over the network.

Unnecessary SMB access can increase the lateral movement risk.

### Why Is RDP Segmentation Important?

TCP/3389 access must be limited only to the necessary administrator sources.

### Why Is SSH Segmentation Important?

TCP/22 access can be provided only through authorized management systems.

### Why Is Database Port Segmentation Important?

Database ports must be opened only to the relevant application and management systems.

For example:

PostgreSQL → TCP/5432

MSSQL → TCP/1433

Oracle → TCP/1521

### Active Directory Network Segmentation

Domain controllers are among the organization's most critical systems.

For this reason DC network access control is of critical importance.

### Does the Domain Controller Have to Communicate With Every System?

No.

An access matrix must be created taking the necessary AD protocols and services into account.

### What Is Tiered Administration?

It is the management of systems at different criticality levels with different administrator accounts and management paths.

### What Is a Privileged Access Workstation - PAW?

It is the hardened and dedicated workstation approach used for administrator operations.

### Can a PAW Be Used Together With Network Segmentation?

Yes.

For example:

PAW

↓

Management Network

↓

Critical Server

### What Is a Network Access Matrix?

It is the matrix that shows which network segment can reach which segment or service.

### An Example Access Matrix

| Source | Destination | Service | Policy |
| --- | --- | --- | --- |
| User | Internet | HTTPS | Allow |
| User | Database | Any | Deny |
| App | Database | DB Port | Allow |
| Guest | Corporate | Any | Deny |
| Admin | Management | Required | Allow |

### Why Is a Network Access Matrix Important?

It ensures that the firewall rules match the business requirement.

### What Is Application Dependency Mapping?

It is the identification of which systems applications communicate with and over which network services.

### Why Is Dependency Mapping Necessary Before Segmentation?

An incorrect firewall rule can create an application outage.

### What Is Network Flow Analysis?

It is the analysis of the real communication patterns on the network.

### Can NetFlow Be Used for Segmentation?

Yes.

It helps to determine which systems communicate with one another.

### Can IPFIX Be Used?

Yes.

Flow telemetry can be used for application dependency discovery.

### Is PCAP Necessary?

It can be used when detailed protocol analysis is required.

### How Is a Segmentation Project Started?

A sound approach can be this:

**Discover → Map → Classify → Design → Enforce → Monitor → Optimize**

### \1. Discover

The network assets are identified.

### \2. Map

System communication and dependencies are derived.

### \3. Classify

The assets are classified according to criticality and function.

### \4. Design

The network segments and the access matrix are created.

### \5. Enforce

Firewall, ACL, NAC or micro-segmentation policy is applied.

### \6. Monitor

Blocked and allowed traffic is analyzed.

### \7. Optimize

Unnecessary access is continuously reduced.

### Can the Segmentation Policy Be Run in Monitor Mode First?

If the technology supports it, yes.

The real communication behaviour can be observed before policy enforcement.

### What Is Policy Simulation?

It is the analysis of the possible impact of a new segmentation rule before it is applied.

### Why Is Segmentation Change Management Important?

An incorrect rule can create a production outage.

### What Is a Segmentation Rollback Plan?

It is the plan for returning to the previous configuration if the change creates a problem.

### Should Network Segmentation Be Tested?

Definitely.

### What Is Segmentation Validation?

It is the testing of whether the defined security boundaries really work.

### How Is a Segmentation Test Performed?

Within the scope of authorized testing, access controls from different segments can be verified.

### Does a Penetration Test Test Segmentation?

Yes.

During an internal penetration test the effectiveness of network segmentation can be evaluated.

### What Is a Segmentation Bypass?

It is the attacker being able to cross the network security boundary through an unexpected path.

### Why Does a Segmentation Bypass Occur?

An incorrect firewall rule

Alternative network path

Dual-homed server

Misconfigured routing

Unauthorized VPN

it can occur for reasons such as these.

### What Is a Dual-Homed Server?

It is a system connected to different networks with more than one network interface.

### Can a Dual-Homed Server Be Risky?

Yes.

It can create an unwanted bridge between two security segments.

### Does Shadow IT Affect Segmentation?

Yes.

Devices or services the IT team does not know about can break the network architecture.

### Can a Rogue Access Point Cross Segmentation?

An incorrectly configured rogue device can create an alternative access path.

### What Is Network Path Analysis?

It is the analysis of the real network path between a source and a destination.

### What Is Asymmetric Routing?

It is the outgoing and returning traffic using different network paths.

### Does Asymmetric Routing Affect the Firewall?

It can create a problem on stateful firewalls.

### What Is VRF?

VRF:

#### Virtual Routing and Forwarding

makes it possible to create routing tables independent of one another on the same network device.

### Can VRF Be Used for Segmentation?

Yes.

It can be used particularly for routing-level isolation.

### Are VRF and VLAN the Same?

No.

A VLAN provides Layer 2 segmentation.

VRF provides Layer 3 routing isolation.

### What Is VRF Lite?

It is the creation of more than one routing instance on a device without requiring MPLS.

### The Relationship Between Network Segmentation and the Firewall

Segmentation creates the security boundary.

The firewall controls the traffic passing through that boundary.

For this reason the two concepts complement each other.

### The Relationship Between Network Segmentation and NDR

Segmentation limits the traffic.

NDR, on the other hand, monitors the behaviour between segments and on the internal network.

### Can NDR Detect Lateral Movement?

If the network telemetry is sufficient it can help to detect suspicious East-West behaviour.

### Network Segmentation and the SIEM

Firewall deny logs,

NAC events,

NDR alerts

and authentication logs

can be correlated on the SIEM.

### What Is a Segmentation Violation?

It is a system attempting network access outside the policy.

### Can a Segmentation Violation Be a SOC Alarm?

Yes.

Unexpected access attempts to critical segments in particular can be a high-value detection use case.

### An Example Detection Scenario

User Workstation

↓

Database VLAN

↓

Repeated Connection Attempt

↓

Firewall Deny

↓

SIEM Alert

If this behaviour is not normal user activity it can be investigated.

### Network Segmentation and Incident Response

During an incident the compromised system needs to be isolated quickly.

### What Is Network Isolation?

It is the cutting of the compromised device's access to other network resources.

### Can NAC Be Used in Incident Response?

Yes.

The device can be moved to the quarantine VLAN.

### Can EDR Perform Network Isolation?

Some EDR solutions can limit endpoint network communication.

### What Is Dynamic Containment?

It is the automatic isolation of a device or workload as a result of a security event.

### Can Segmentation Automation Be Done With SOAR?

If there is suitable integration, yes.

For example:

NDR Alert

↓

SIEM Correlation

↓

SOAR Playbook

↓

NAC Quarantine

### The Relationship Between Segmentation and Compliance

Network segmentation can be used as a risk-reducing control in various security and compliance frameworks.

The separation of systems processing critical data in particular from other network areas is a strong security approach.

### PCI DSS and Network Segmentation

The separation of the Payment Card Environment from other network areas can be important in terms of scope reduction.

### ISO 27001 and Network Segmentation

In terms of the information security controls within the scope of ISO/IEC 27001, network security and segregation are among the important technical topics.

### Zero Trust and Network Segmentation

In the Zero Trust approach network location alone is not an indicator of trust.

For this reason modern segmentation:

#### IP-Based

from this approach

**Identity + Device + Workload + Context-Based**

is progressing towards this approach.

### Network Segmentation KPIs

Organizations can track the following metrics:

Critical Asset Segmentation Coverage

Unrestricted Network Paths

Segmentation Policy Violations

Unknown Device Count

Firewall Rule Risk

### What Is Segmentation Coverage?

It shows how much of the critical assets are protected with a suitable network security boundary.

### What Is an Unrestricted Network Path?

It is the presence of broader access than necessary from a source to a critical destination.

### What Is a Segmentation Risk Score?

It is the measurement of the risk level of network access through criticality and exposure.

### Network Segmentation Dashboard

A dashboard can show the following information:

Critical Segments

Open Network Paths

Policy Violations

Lateral Movement Alerts

Unknown Devices

Segmentation Coverage

### The Most Frequently Made Mistakes in Network Segmentation

The mistakes frequently seen in organizations are these:

- Using a flat network
- Thinking that creating a VLAN is sufficient security
- Not controlling inter-VLAN routing
- Not separating the user and server networks
- Not protecting the database segment
- Not isolating the backup network
- Leaving management interfaces reachable from the user VLAN
- Not separating guest Wi-Fi from the corporate network
- Keeping IoT devices on the user network
- Not taking same-VLAN traffic into account
- Not monitoring East-West traffic
- Using Any-Any firewall rules
- Applying segmentation without doing application dependency mapping
- Not controlling dual-homed systems
- Not testing the segmentation policy

### Network Segmentation Checklist

- Is the network topology up to date?
- Is an asset inventory available?
- Have the critical assets been identified?
- Have the user and server networks been separated?
- Is the database segment separate?
- Is the backup segment separate?
- Is the management network separate?
- Is the guest Wi-Fi isolated?
- Has the IoT network been separated?
- Has the OT network been separated?
- Is a firewall being used between the VLANs?
- Is inter-VLAN access being controlled?
- Is there Any-Any access?
- Is East-West traffic visible?
- Has micro-segmentation been evaluated?
- Is NAC being used?
- Is there a quarantine VLAN?
- Is an access matrix available?
- Has application dependency mapping been done?
- Is segmentation being tested?
- Do the firewall logs go to the SIEM?
- Is there lateral movement detection?

### Network Segmentation Maturity Model

#### Level 1 - Flat Network

Systems can largely reach one another.

#### Level 2 - VLAN Segmentation

Basic VLANs such as user, server and guest have been separated.

#### Level 3 - Security Zone Enforcement

The traffic between VLANs and zones is controlled with firewall policy.

#### Level 4 - Micro-Segmentation

Workload-to-workload access is controlled at a granular level.

#### Level 5 - Zero Trust Segmentation

Dynamic access control is applied through identity, device posture, workload and risk context.

### Frequently Asked Questions

#### What is Network Segmentation?

Network Segmentation is the separation of the network into different segments according to security and business requirements and the control of access between the segments.

#### What is a VLAN?

A VLAN is the technology that makes it possible to create logical network segments on a physical network.

#### Does a VLAN provide security?

A VLAN provides segmentation but on its own it is not a sufficient security control. The access between segments needs to be controlled with a firewall or ACL.

#### What is Inter-VLAN Routing?

It is the routing operation that allows different VLANs to communicate with one another over the network.

#### What is a Flat Network?

It is the network structure in which network security boundaries are limited and a large number of systems can reach one another broadly.

#### What is Micro-Segmentation?

It is the application of granular network access control at workload or application level.

#### What is Lateral Movement?

It is the attacker trying to progress from the first system they have compromised to the other systems inside the network.

#### What is Blast Radius?

It is the total scope of the systems a security incident can affect.

#### What is East-West Traffic?

It is the network traffic between internal servers, endpoints and workloads.

#### What is North-South Traffic?

It is the traffic between the corporate network and the internet or external systems.

#### What is the Management Network?

It is the separate network segment used for the management interfaces of systems such as firewalls, switches, routers, hypervisors and servers.

#### Why should the Backup Network be separated?

In order to make it harder for ransomware and lateral movement attacks to reach the backup infrastructure.

#### What is Zero Trust Segmentation?

It is the application of access policy through identity, device, workload and context instead of network location.

#### Does Network Segmentation prevent ransomware attacks?

It does not prevent them on its own but it can make it seriously more difficult for ransomware to spread inside the network and to reach critical systems.

### Conclusion: Network Segmentation Is Not a VLAN Project, It Is the Design of Trust Boundaries

Network Segmentation is most often handled as:

**"Let us separate the VLANs."**

in this way.

However, real network segmentation is far more than this.

The real question:

#### Which system should be able to communicate with which system, for which reason and over which service?

should be this.

The basic logic of a strong segmentation architecture:

#### Discover

↓

#### Classify

↓

#### Segment

↓

#### Restrict

↓

#### Monitor

↓

#### Validate

is in this form.

For example, in an organization:

User Network

Server Network

Database Network

Backup Network

Management Network

Guest Network

IoT Network

OT Network

may be separate.

However, if the access between these segments is not controlled, only different IP subnets have been created.

The real security value:

**emerges with the limiting of the trust relationships between the segments.**

In modern attacks it must be accepted that the perimeter can be crossed.

For this reason the real goal:

**"The attacker cannot get inside."**

is far less about saying this than:

**"Even if they get inside, where can they reach?"**

about answering this question.

When a user computer is compromised, if the attacker;

Database,

Backup,

Management,

Domain Controller,

Hypervisor

cannot reach critical systems such as these directly, segmentation shrinks the blast radius of the attack.

For this reason in the modern Network Security architecture:

**Segmentation = Lateral Movement Control**

it can be thought of in this way.

At a more advanced maturity level the classical VLAN approach:

**VLAN → Security Zone → Internal Firewall → Micro-Segmentation → Zero Trust Segmentation**

develops through this path.

In the end the purpose of a well-designed network is not to connect every system to every other.

The aim:

**is to connect only the systems that really need to communicate, only over the services they need.**