Network segmentation

In a flat network, every device can talk to every other device. Once an attacker compromises one laptop, they can scan and attack servers, domain controllers and backups directly. Segmentation breaks the network into zones, such as user workstations, servers, management systems, payment systems and industrial equipment, and allows only the traffic each zone actually needs, enforced by firewalls, VLANs and access rules.

Microsegmentation takes the idea further, applying rules between individual workloads, for example allowing a web server to talk to its database on one port and nothing else. MITRE ATT&CK lists network segmentation as a mitigation (M1030) for many techniques, especially lateral movement.

Example

Ransomware encrypts a group of office workstations. Because workstations cannot connect directly to each other or to the server management interfaces, and the backup network is reachable only from the backup servers, the attack stays confined to one segment, and the backups survive.

Why it matters for a SOC analyst

Segmentation shapes both the scope of an incident and the quickest containment options: blocking traffic between two zones is often faster than isolating dozens of hosts one by one. Traffic that crosses zones where it should not, such as a workstation connecting to another workstation over SMB or RDP, is also an excellent detection signal for lateral movement.