What is microsegmentation?

What is microsegmentation?

Microsegmentation divides a network into very small zones, often a single workload each, and controls which workloads may talk to which. Traditional segmentation draws boundaries around whole subnets or VLANs and filters only the traffic that crosses between them, so everything inside one segment can still reach everything else. Microsegmentation puts a policy around each server, virtual machine, container or application tier, and two systems on the same subnet can communicate only if a rule allows it. Its main purpose is to stop lateral movement, the way attackers spread from the first system they compromise.

How it is enforced

Because the rules sit at the workload rather than at a central router, enforcement happens close to each system:

• host-based firewalls or agents on each server, managed from one console
• a distributed firewall built into the hypervisor's virtual switch
• cloud security groups, which can reference other groups instead of IP addresses
• Kubernetes network policies for pods
• a service mesh that requires mutual TLS identities between services

Rules are usually written against labels such as application, tier and environment rather than IP addresses, so they follow a workload when it moves, scales out or gets a new address.

Example: containing a web server compromise

A three-tier HR application shares a data center subnet with dozens of unrelated servers. Its intended flows become policy:

When an attacker exploits the web server, they can reach the application tier on one port and nothing else. Attempts to connect straight to the database, or to SMB on the neighboring file servers, are dropped and logged, which turns a quiet intrusion into an alert.

Deploying microsegmentation

The hard part is knowing every legitimate flow. Forget one, such as a nightly batch job or a monitoring check, and enforcement breaks it. Teams therefore start by watching rather than blocking: they collect flow data for a few weeks to learn who talks to whom, write rules from that map, run the rules in a log-only state to catch surprises, and only then switch to default deny. The policy needs upkeep afterward as applications change.

Microsegmentation and zero trust

Microsegmentation applies zero trust thinking to server-to-server traffic. Sharing a network earns a workload nothing; each connection has to match an explicit rule tied to the workload's identity. NIST SP 800-207 describes microsegmentation as one of the main approaches to building a zero trust architecture, with enforcement gateways placed in front of individual resources or small groups of them.

Microsegmentation vs. VLANs and ZTNA

A VLAN is a coarse segment: it separates broadcast domains, and filtering happens only where traffic is routed between VLANs. Microsegmentation filters inside the segment, down to the workload. ZTNA controls how users reach applications, while microsegmentation controls how workloads reach each other. Many organizations use all three.

Microsegmentation on the CompTIA Security+ exam

Microsegmentation is taught as part of zero trust architecture under SY0-801 objective 3.2, and objective 4.1 lists segmentation among the mitigating controls, with microsegmentation as its most granular form. Scenario wording such as limit lateral movement between servers on the same subnet, workload-level policy, policy that follows the workload or east-west traffic points here. A new VLAN is the tempting distractor when the question stresses individual workloads, and a perimeter firewall is wrong because traffic between internal servers never crosses it.