Zones and boundaries
Isolation changes what a system can reach.
A segmented network places systems with different roles or trust requirements into separate zones. A workstation network, a server zone, and a guest network may have different paths and policies between them.
Segmentation can use virtual local area networks (VLANs), subnets, routing boundaries, cloud security groups, or application-level identity. It reduces unnecessary reachability, but it does not replace patching, authentication, monitoring, or a precise firewall policy.
Limit lateral movement
Internal access deserves boundaries too.
A perimeter boundary is not enough when a compromised workstation can reach every internal server. Micro-segmentation applies smaller policies between workloads, applications, or identities, including traffic moving east-west inside a network.
The goal is not to make communication impossible. It is to keep each permitted path specific, observable, and limited so one compromised system has fewer useful routes to other assets.
Build the model
Four segmentation questions
Role
Which systems belong together because they serve a similar function?
Boundary
Which device or policy controls movement between the zones?
Flow
Which source must reach which destination and service?
Evidence
How will logs, tests, and monitoring show that the policy works?
Mini investigation
Classify a cross-zone request
Select the observed flow and identify the most direct design question.
A workstation needs a specific application service in the server zone.
Document the destination, port, direction, identity, and reason for access.
Knowledge check
Test your segmentation model
Answer eight questions. The answer order changes each time.