Segmentation will not stop every intrusion, but it limits how far an attacker can move. Zone design, microsegmentation, enforcement and common pitfalls.
Network segmentation divides an infrastructure into zones whose communications are explicitly controlled, so that an attacker who compromises one workstation or server cannot freely reach the rest of the network. It does not prevent the initial intrusion, but it slows down lateral movement, reduces the scope of an incident and makes suspicious traffic easier to spot. For many organisations, it is one of the most effective measures available to contain ransomware.
After gaining an initial foothold, often through phishing, stolen credentials or an exposed vulnerability, an attacker rarely stays on the first machine. They enumerate the network, harvest credentials, and move towards high-value systems such as domain controllers, backup servers and databases, typically through administrative protocols like SMB, RDP, WinRM or SSH. In a flat network where every host can talk to every other host, nothing stands in the way. CISA's #StopRansomware Guide explicitly recommends network segmentation among its prevention measures for this reason.
Segmentation can be applied at different levels of granularity:
CISA published Microsegmentation in Zero Trust, Part One: Introduction and Planning in July 2025. The document presents microsegmentation as a core building block of zero trust architecture, able to shrink the attack surface, limit lateral movement and improve visibility. It focuses on planning, with a second, more technical part announced to follow. NIST SP 800-207 likewise lists microsegmentation as one of the deployment approaches for zero trust.
A segmentation project starts with understanding, not with configuration. The usual steps are:
Some zones deserve special attention. The administration network, from which privileged accounts manage servers and network devices, should be reachable only from dedicated admin workstations or a bastion. Backup infrastructure should be isolated so that compromised production credentials cannot delete or encrypt backups. Operational technology networks follow the zones and conduits model of the ISA/IEC 62443 standards.
Next-generation firewalls are the most common enforcement point between zones, because they filter by application and user identity, not only by port, and can inspect traffic for known threats. Network access control solutions place devices into the right segment at connection time based on their identity and posture. In virtualised and cloud environments, security groups and distributed firewalls do the same job closer to the workload.
A segmentation policy decays if nobody checks it. Rules added for a temporary project stay in place, exceptions accumulate and zones slowly merge. Good practice includes periodic rule reviews, removal of unused rules, and testing: a simple scan from a user segment towards the admin zone should fail. Logging denied flows between zones is also valuable, since an unusual attempt to reach a domain controller from a printer segment is a strong signal for the SOC.
Segmentation requires both network engineering and security analysis skills. The CND v3 Certified Network Defender training covers network defence design, including zoning, firewalls and traffic monitoring. For teams enforcing zones on FortiGate firewalls, the FortiOS 7.6 Administrator – NSE 4 certification preparation addresses firewall policies, interfaces and inspection. Industrial environments can rely on the ISA/IEC 62443 Cybersecurity Fundamentals Specialist (IC32) certification preparation to apply the zones and conduits approach.
Segmentation will not stop every intrusion, but it turns a network where a single compromise spreads everywhere into one where the attacker must break through several controls, each of which can raise an alert. Start with a flow map, protect administration and backups first, move gradually towards finer granularity, and review the rules regularly so that the design stays effective over time.