Purpose
Segmentation reduces unnecessary connectivity, limits lateral movement, protects sensitive systems, and creates points where access policy and monitoring can be applied.
Methods
- Physical separation
- VLANs and routed network zones
- Firewalls and security gateways
- Cloud network controls
- Application-aware and identity-aware access
- Host-level and workload-level microsegmentation
Design questions
What communicates, why is it required, which direction is allowed, which protocols are necessary, who owns the exception, and what evidence confirms the policy is working?
Common failure
A network diagram may show separate zones while broad rules, shared administration, unmanaged paths, or hidden dependencies make the separation ineffective.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: