Network Segmentation - Stopping Lateral Movement

About 2 min read

Network segmentation is a technique that divides an organization's network logically or physically into multiple segments (zones) and restricts communication between segments using firewalls and access control lists. Even if an attacker breaches one segment, the damage can be localized by preventing lateral movement to other segments. As of 2025, with the spread of zero trust architecture, the adoption of microsegmentation is accelerating.

What Changes When an Infection Actually Occurs

The value of segmentation shows most clearly when an incident such as a malware infection actually occurs. In a flat, undivided network, a single infected machine puts the entire organization at risk, and both investigation and recovery must cover every system. When communication between segments is restricted, the spread of damage stops at the segment boundary, and identifying the affected scope, containing it, and recovering can be narrowed down to that zone. Segments that are not affected can keep operating, which makes it easier to balance incident response with business continuity. Communication restrictions that may seem inconvenient in normal times act as insurance at incident time, capping the extent of the damage.

Conceptual Diagram of Network Division

Segmentation Methods

Physical segmentation separates networks using dedicated switches and routers; it is the most reliable but the most costly. Logical segmentation using VLANs (virtual LANs) can separate multiple networks on a single switch and offers excellent flexibility. Microsegmentation is the latest approach, based on the concept of zero trust, that controls communication at the workload level.

Design Points in Practice

PCI DSS defines as a requirement that systems handling cardholder data be separated from other networks. A common design is based on four zones: a server segment, a user segment, a DMZ, and a management segment, subdivided further according to business requirements. As a principle, communication rules between segments should follow "default deny," and a whitelist approach that explicitly permits only the necessary communication is recommended. Protect the management consoles of network devices with strong random passwords to prevent unauthorized changes to segmentation rules.