In 2013 attackers stole network credentials from a heating and air-conditioning contractor and used them to get into Target's network. From that foothold they reached the point-of-sale systems and stole around 40 million payment card numbers. The contractor's access had nothing to do with the registers; the network simply never stopped one from leading to the other.
On the CompTIA Security+ SY0-801 exam, segmentation and access controls are the first two mitigations listed under objective 4.1, which expects you to apply the right control in a scenario. This lesson covers why segmentation works as a mitigation, how VLANs and subnets divide a network, how router and switch ACLs control the paths between segments, what microsegmentation adds, why IoT and OT devices are isolated, and how access controls limit what a compromised account can reach.
Segmentation limits how far an attacker can move after the first compromise
On a flat network, every device can reach every other device. One phished workstation can talk to the domain controllers, the databases and the backup server, and ransomware can spread to all of them in minutes. Segmentation divides the network into separate segments and controls the paths between them.
As a mitigation, segmentation does four jobs. It limits lateral movement, so a compromise in one segment doesn't automatically become a compromise everywhere. It contains incidents, because responders can isolate one segment without shutting down the whole network. It protects devices that can't protect themselves by putting a control in front of them. And it reduces compliance scope: under PCI DSS, systems properly segmented away from the cardholder data environment can fall outside much of the assessment.
Segmentation can be physical, with separate switches and cabling, or logical, with VLANs, subnets, access lists and firewalls on shared hardware. Most organizations rely on logical segmentation and keep physical separation for the most sensitive systems. Security zones and where devices are placed are covered in the network zones section, and air-gapped networks in the architecture section.
VLANs and subnets divide the network, but a control point must sit between them
A VLAN is a logical Layer 2 network on shared switches. Frames crossing a trunk link carry an 802.1Q tag with a 12-bit VLAN ID, so usable IDs run from 1 to 4094. Each VLAN is normally its own IP subnet and broadcast domain:
| VLAN | Purpose | Subnet |
|---|---|---|
| 10 | Staff workstations | 10.10.10.0/24 |
| 20 | Servers | 10.10.20.0/24 |
| 40 | IoT: cameras, badge readers, sensors | 10.10.40.0/24 |
| 50 | Guest Wi-Fi | 10.10.50.0/24 |
| 99 | NAC quarantine | 10.10.99.0/24 |
The key point is that VLANs alone are not a security control. Traffic between VLANs has to be routed, and if the router or Layer 3 switch routes between them without filtering, every VLAN can still reach every other one. The protection comes from the control at the routing point: an access list on the Layer 3 switch or router, or a firewall that does the inter-VLAN routing.
VLANs also have their own attacks. In switch spoofing, an attacker's device negotiates a trunk link with the switch and gains access to every VLAN. In double tagging, frames carrying two 802.1Q tags hop from the native VLAN into another one. The mitigations are standard hardening: set user ports to access mode and turn off automatic trunk negotiation, keep user traffic off VLAN 1 and the native VLAN, and shut down unused ports and park them in an unused VLAN.