Dividing networks into separate zones to contain breaches and limit lateral movement.
Network segmentation divides networks into separate zones or segments, controlling traffic between them. Segmentation contains breaches—if attackers compromise one segment, they can't easily move to others. Critical systems, guest networks, and IoT devices should be on separate segments. Segmentation is implemented through VLANs, firewalls, and access control lists. It's a core principle of defence in depth and Zero Trust architectures.
Why It Matters
The DSC Perspective:
Flat networks let attackers move freely after initial compromise. Segmentation limits the blast radius of breaches. At minimum, separate guest/IoT networks from corporate systems.