Network segmentation in plain English
In many companies, the network is “flat”: all devices sit on the same network – laptops, servers, printers, cameras, and sometimes even the production controllers. Every device can talk to every other device. That’s convenient, but dangerous. Once an attacker has taken over a single computer, for example through a phishing email, they can reach and attack every other device on the network from there.
Segmentation brings order to this. An everyday comparison is a building divided into fire compartments: fire doors split it into sections so that a fire stays contained in one section – but only if the doors are closed. A fire door that is permanently propped open with a wedge is useless. The same goes for overly permissive rules between network zones.
How network segmentation works
- Define zones: Devices are grouped by function and protection requirements – for example, into zones for workstations, servers, administrative access, production, guest Wi-Fi, and connected devices such as cameras. Systems that need to be reachable from the internet sit in a zone of their own, the DMZ.
- Separate the zones technically: This is often done with VLANs – virtual networks that logically divide a physical network. But a VLAN alone isn’t a protective wall. What matters is that traffic between zones passes through a firewall – a kind of border checkpoint for data – and is filtered there. Particularly critical areas are sometimes physically separated as well.
- Set rules: By default, anything that isn’t explicitly permitted is prohibited. Workstations may reach the inventory management system, for example, but not the servers’ administrative interfaces or the backup systems.
- Maintain and test: The rule set is documented, exceptions are time-limited, and effectiveness is tested regularly.
A further development is microsegmentation, which isolates even individual servers or applications from one another. It’s an important building block of Zero Trust, a security approach that doesn’t automatically trust any device or connection.
A practical example
Here’s a typical scenario: Two years ago, a mid-sized machinery manufacturer divided its network into zones for office, servers, production, and guests. A segmentation test shows that nothing can actually be reached from the guest Wi-Fi. From the office network, however, the testing team gets through to the production control computers unhindered.
The cause is a firewall rule from a commissioning project that was only meant to be “temporary.” If an office PC had been infected with ransomware, the malware could have brought production to a standstill as well. The company removes the rule and, from now on, grants exceptions only for a limited time.
Why does this matter for businesses?
Many serious attacks follow the same pattern: first, a single computer is compromised – that is, taken over by attackers. Then the attacker moves step by step through the network – what experts call lateral movement – to the servers, to Active Directory as the central user management system, and to the backups. Effective segmentation breaks this chain or slows it down so much that the attack is more likely to be noticed.
Segmentation also limits the damage: if only one zone is affected, the others keep running. Frameworks build on this principle, too. The IT-Grundschutz methodology of the BSI (Germany’s Federal Office for Information Security) and the IEC 62443 series of standards for industrial facilities both rely on separate zones. And if you use segmentation to reduce your scope under PCI DSS 4.0.1, the payment card industry’s security standard, you must regularly demonstrate its effectiveness through penetration tests.
How to protect your organization
- Wall off your crown jewels: Apply the strictest separation to your most important systems, such as Active Directory, backups, and production.
- Block by default: Allow only those connections between zones that are actually required for operations.
- Separate administration: Perform administrative tasks through a dedicated management network or secured intermediate computers, known as jump servers – not from regular workstations.
- Isolate guests and devices: Guest Wi-Fi, cameras, building technology, and other connected devices belong in zones of their own.
- Time-limit exceptions: Give every special rule a justification, an owner, and an expiration date.
- Test effectiveness: Check regularly, and after any changes to the network, whether the separation actually delivers in practice what the network diagram promises.
How Rootsektor can help
As part of our penetration tests for Network & Infrastructure, we use a segmentation test to check from an attacker’s perspective whether your network zones are actually separated the way your network diagram says they are. We carry out internal tests either on site or remotely, as you prefer. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person. After scoping, you’ll receive a fixed-price quote – you can request it via our Pentest Quote page.