Network segmentation matters because it limits lateral movement. If an attacker compromises one machine on a flat network, every reachable system is a candidate next target. Segmented networks put boundaries and rules between zones, so one phished laptop does not become a company-wide outage.
What problem does segmentation solve?
Most intrusions do not end at the first foothold. The attacker lands on one workstation or server, then looks around for something more valuable. On a flat network, that search is easy, because nearly everything can talk to nearly everything.
CISA's #StopRansomware Guide makes the point directly. It says network segmentation can help contain the impact of an intrusion and prevent or limit lateral movement, and it includes diagrams of a flat network next to a segmented one. The same guide adds a caveat worth remembering: segmentation can be rendered ineffective if it is breached through user error or non-adherence to policy, for example when someone connects removable media or devices to several segments.
What did the DarkSide advisory say about it?
In May 2021, CISA and the FBI published advisory AA21-131A after a ransomware attack on a US pipeline company's IT network. The advisory states that, at that point, there was no indication that operational technology networks had been directly affected. It then urged critical infrastructure operators to implement strong segmentation between IT and OT networks, test manual controls, and keep backups isolated from network connections.
The lesson is about blast radius. The company reported that it proactively disconnected certain OT systems to keep them safe. A clean boundary between business systems and operational systems gave defenders a choice they might not otherwise have had.
What does zero trust add?
NIST SP 800-207 on zero trust architecture takes the idea one step further. It says zero trust grants no implicit trust to assets or accounts based only on physical or network location, and that it focuses on protecting resources rather than network segments. Read that carefully. It does not say segments are useless. It says a segment boundary alone is not proof that traffic is safe, so authentication and authorization still happen for each session.
Segmentation and zero trust work together. Segments reduce what is reachable. Per-session checks reduce what is allowed.
What does a useful segment look like?
Constructed example: a mid-sized firm has user laptops, a payment server, a build system and some printers. In the flat version, a printer vulnerability gives access to the payment server. In the segmented version:
- User laptops sit in one zone that can reach the internet and a short list of internal apps.
- The payment server sits in its own zone, reachable only from two named application servers on specific ports.
- The build system sits in a third zone that accepts connections from developers through an authenticated gateway.
- Printers and other devices that cannot run security agents sit in a quarantined zone with no route to the others.
Notice that the rules are written from what a system needs, not from where it physically sits.
Where does segmentation fail in practice?
- Rules start strict and loosen over time as people open ports for urgent requests and never close them.
- "Any to any" rules sneak into shared services such as backup, monitoring and remote management.
- Flat management networks give administrators one door that opens everywhere, and attackers value those credentials.
- Nobody tests it. A diagram shows intent; a connection attempt shows reality.
How to check or apply this
- List your critical systems and the few things each one truly needs to talk to.
- Draw current reachability, not intended reachability, by testing from a normal user laptop.
- Separate the highest-value zones first, such as payment systems, backups and identity servers.
- Keep backups isolated from the networks they protect, as CISA advises.
- Review firewall rules on a calendar and remove any rule with no owner.
- Retest after every change and after every incident.
Quick check
Is segmentation the same as microsegmentation?
Not quite. Segmentation divides a network into zones. Microsegmentation applies the same idea at the level of individual workloads, with finer policy. Both aim to limit lateral movement.
Does segmentation replace endpoint security?
No. It limits spread after a compromise; it does not stop the first one. Treat it as one layer next to patching, multifactor authentication and monitoring.
Sources
- CISA #StopRansomware Guide
- CISA and FBI advisory AA21-131A, DarkSide Ransomware
- NIST SP 800-207, Zero Trust Architecture
Last reviewed: 18 October 2026.
