What is network segmentation?

What is network segmentation?

Network segmentation splits one network into smaller segments and places a control point on every path between them. On a flat network, any device can reach any other, so one phished laptop can talk to domain controllers, databases and backup servers. On a segmented network, traffic between segments must pass a firewall or access control list that permits only the flows each segment needs.

Segmentation does several jobs at once. It limits lateral movement after a first compromise, keeps ransomware and worms to a smaller area, lets responders isolate one segment without taking down the whole network, shields devices that cannot protect themselves, and can shrink compliance scope.

Physical vs. logical segmentation

Physical segmentation gives each segment its own switches, cabling and firewalls. It is the stronger form, because no shared device can be misconfigured to merge two segments, and an air gap is its extreme case. It costs more hardware and is harder to change.

Logical segmentation separates traffic on shared hardware by configuration: VLANs, IP subnets, router and switch ACLs, firewall rules, and cloud constructs such as virtual private clouds and security groups. It is cheaper, flexible and what most organizations use, but it is only as good as its configuration. A VLAN counts as logical segmentation even though it runs on physical switches, which is a frequent exam trap.

How it works: VLANs, subnets and ACLs

A common design gives each group of devices its own VLAN and subnet:

VLANs by themselves filter nothing. Inter-VLAN traffic must cross a router or Layer 3 switch, and when that device forwards it without restrictions, every segment can still reach every other. The protection comes from the ACL or firewall at that routing point, written as default deny with named exceptions. VLANs also need hardening against VLAN hopping: put user ports in access mode, disable automatic trunk negotiation and keep user traffic off the native VLAN.

Zones, screened subnets and microsegmentation

Segments are often grouped into security zones by trust level. A screened subnet, also called a DMZ, holds the systems the internet must reach, such as public web servers and mail relays, so compromising one of them does not land the attacker on the internal network. Restricted zones hold sensitive data and accept connections only from named application servers, and management interfaces sit in their own zone.

Microsegmentation pushes the idea down to individual workloads. Rather than trusting everything inside a subnet, it wraps a policy around each server or container, enforced by host firewalls, hypervisor firewalls, cloud security groups or Kubernetes network policies, so servers sharing a subnet still need an explicit rule before they can connect. It answers east-west movement between servers and fits a zero trust design.

Compliance and systems you cannot fix

PCI DSS does not require segmentation, but isolating the cardholder data environment reduces how many systems fall in scope for assessment. When segmentation is used that way, PCI DSS v4.0.1 requires penetration testing of the segmentation controls at least once every 12 months (every six months for service providers) and after any change to those controls. The same approach protects systems that cannot be patched or hardened, such as an unsupported server, IoT devices with fixed firmware, or operational technology only the vendor may update. Each goes in its own segment, reachable only from the hosts and on the ports that need it, which makes segmentation a compensating control.

Network segmentation on the CompTIA Security+ exam

Segmentation is the first mitigation listed in SY0-801 objective 4.1 on mitigating controls. Physical and logical segmentation and air gaps appear in objective 3.1 on architecture models, and zones such as the screened subnet in objective 3.2. Wording that points to segmentation: limit how far ransomware can spread, isolate a legacy system that cannot be patched, keep IoT devices or guests off the corporate network, or reduce PCI DSS scope. East-west movement among servers that share a subnet points to microsegmentation. Common distractors are moving a device to another VLAN with no filtering, which changes its address but not its reach; an IDS, which can see lateral movement but cannot stop it; and encryption, which protects data but does not block connections.