Network segmentation divides a network into separate zones and controls the traffic allowed between them, so a breach in one zone does not give access to everything. Start by grouping systems by sensitivity and function, then add deny by default rules between zones one step at a time.
Why segment at all?
Flat networks make attackers' lives easy. Once on one machine, they can scan the internal range and try every reachable service. Segmentation limits that lateral movement and shrinks the number of systems an incident touches.
It also helps compliance. The PCI Security Standards Council has published guidance on scoping and network segmentation because isolating systems that handle payment data can reduce how much of an environment falls under the standard. Segmentation does not remove obligations by itself, so confirm how an assessor will treat yours.
What do the standards say?
NIST SP 800-53 Revision 5 control SC-7, Boundary Protection, calls for monitoring and controlling communications at external managed interfaces and at key internal managed interfaces within the system. It asks for subnetworks for publicly accessible components that are separated from internal networks. Enhancement SC-7(5) says to deny traffic by default and allow it by exception. SC-7(21) is about isolating components that support specific missions or business functions.
NIST SP 800-41 Revision 1 covers the firewalls that commonly enforce these boundaries.
How do you choose the zones?
Group by what the systems do and how much damage a compromise causes. Common starting zones are:
- Internet facing systems, kept apart from everything internal.
- User workstations.
- Servers and application tiers.
- Databases and data stores, reachable only from the application tier.
- Management and administration interfaces.
- Guest and unmanaged devices, including visitors and some IoT equipment.
- Operational technology or lab equipment, if you have it.
Too many zones become unmanageable. Too few give little benefit. Begin with a handful and refine.
What enforces the boundary?
Firewalls, router access lists and virtual LANs are the classic tools. In cloud networks, security groups and subnets do the same job. Host based firewalls add a layer on each machine. Identity based policies can supplement all of them, though IP based zones are easier to explain at first.
Note that a virtual LAN by itself separates broadcast domains. It only provides security if traffic between VLANs passes through a point that enforces rules.
Constructed example: protecting the order database
A shop's web server, application server and order database sit on one subnet. A flaw in the web server lets an attacker run commands. From there, they connect straight to the database port and copy customer data.
After segmentation, the web tier lives in one zone, the app tier in a second and the database in a third. Rules allow only web to app on one port and app to database on one port. The same web server flaw now gets the attacker a foothold with no direct route to data. They must also compromise the app tier, which is a second, harder step that also leaves more traces.
How do you avoid breaking things?
Map before you block. Record which systems talk to which, using flow logs or firewall logs over a few weeks. Write rules from observed needs. Deploy in monitor or log only mode first where tools allow, review what would have been blocked, then enforce. Keep a rollback plan and test with the application owners.
How to check or apply this
- List systems and group them into a small number of zones by function and sensitivity.
- Collect traffic flow data to learn real dependencies.
- Write allow rules between zones and end with a deny.
- Pilot on one zone, usually the most sensitive data store.
- Log denied traffic and review it weekly at first.
- Test from a workstation zone that it cannot reach database ports, and document the result.
- Review rules on a schedule and remove ones nobody owns.
Segmentation controls where traffic may flow. It does not fix vulnerabilities in the apps behind it, so keep scanning code and dependencies too.
Quick check
Is a VLAN the same as segmentation?
Not by itself. A VLAN separates traffic at layer two. Real segmentation needs rules enforced wherever traffic crosses between VLANs.
What should the first segment be?
Usually the most sensitive data store, such as a database with customer or payment data, since protecting it first gives the largest risk reduction.
Sources
- NIST SP 800-53 Rev. 5 control catalog, SC-7 (OSCAL, NIST GitHub)
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- PCI Security Standards Council, guidance on PCI DSS scoping and network segmentation
Last reviewed: 18 October 2026.
