Why Segment a Network?
Security isolation: segmentation contains breaches. If an attacker compromises a device in one segment, they cannot automatically reach devices in other segments without traversing a router or firewall where rules can inspect and block the traffic. This is the principle of least privilege applied to network access.
Performance: segmentation reduces broadcast domains. Every broadcast frame must be processed by every device in the broadcast domain — large flat networks waste CPU cycles on broadcasts. Segmentation into subnets or VLANs reduces the size of each broadcast domain and improves overall network performance.
Compliance and policy: regulations like PCI DSS require that cardholder data environments be isolated from general corporate networks. HIPAA requires protected health information systems to be separated from public-facing systems. Segmentation is a foundational compliance control.
Segmentation Methods
VLANs (Virtual LANs): create logical broadcast domains within a single physical switch infrastructure using 802.1Q tags. Traffic between VLANs requires a router or Layer 3 switch. VLANs are the most common LAN segmentation method. VLAN 1 is the default native VLAN on most switches — best practice is to change the native VLAN and disable VLAN 1 on trunks.
Subnets: IP-level segmentation. Each subnet is a separate Layer 3 network with its own IP range. Devices in different subnets must communicate through a router. Subnetting is often combined with VLANs — each VLAN gets its own subnet.
DMZ (Demilitarized Zone): a special segment between the internet and the internal network where public-facing servers (web, email, DNS) are placed. A DMZ is protected by firewalls on both sides — one facing the internet and one protecting the internal LAN. If a DMZ server is compromised, the attacker still faces the internal firewall.
Air gap: the most extreme segmentation — a completely isolated network with no physical or logical connection to other networks. Used for critical systems like nuclear plant controls, classified government systems, or financial trading systems that must be protected from internet-based attacks.
Zero Trust and Microsegmentation
Traditional perimeter security trusted everything inside the network. Zero Trust assumes no implicit trust — every access request must be authenticated and authorized regardless of network location. 'Never trust, always verify' is the zero trust mantra.
Microsegmentation applies segmentation at a granular level within a data center or cloud environment — each workload or application tier is isolated from others. Even if an attacker moves laterally within the data center, microsegmentation limits how far they can travel. Software-defined firewalling enforces microsegmentation policies.