Network segmentation separates trust zones so a compromise in one area cannot freely reach every other system on the network.
The control is the boundary and the allowed paths between zones, which is more specific than the general aim of network security.
How it works
A zone might hold guest wireless, another building controls, another the identity systems, and traffic between them is denied unless a rule names it.
Segmentation limits blast radius: a camera that is taken over should not be able to open a payroll database just because both use internet protocol.
Drawing zones on a diagram does nothing until routing, firewall rules, and identity checks actually enforce the drawing.
Teams also revisit zones when a project adds a shortcut, because one temporary any to any rule erases the design.
Concrete examples
- Point of sale terminals can speak to the payment processor and cannot open file shares used by the corporate office.
- A research lab network has no route to the identity servers except through a jump host that requires a separate login.
- Building cameras sit on a segment that may reach their recorder and may not initiate connections to laptops.
Protective measures
- Name each zone by what it is allowed to reach, and deny the rest instead of leaving an implicit allow.
- Remove temporary any to any rules on a dated ticket so they cannot become the real architecture.
- Test from inside a low trust zone and confirm it cannot open high value ports you believe are isolated.
- Place new connected devices into a zone on purpose instead of dropping them onto the flat office network.