Network Segmentation

Try it out loud first. Then check yourself:

1. Segmentation splits the network into zones (VLANs, subnets, VPCs) with enforced policy between them
2. Goal is limiting blast radius: a compromised workstation should not reach domain controllers or OT directly
3. Enforce with ACLs and firewalls at zone boundaries; a VLAN alone is not a security control without filtering
4. Microsegmentation applies per-workload policy (host firewalls, SDN) for east-west traffic
5. Validate with flow logs and reachability testing; flat networks are a common ransomware amplifier

If the interviewer pushes back

• How would you segment a hospital network where medical devices cannot run agents?

Go deeper

• csrc.nist.gov/pubs/sp/800/207/final