Network Segmentation

Organizations long protected networks with a perimeter firewall at the internet gateway, or a pair of firewalls around a demilitarized zone between trusted and untrusted zones. A flat network, treated as one trusted segment, needs only a single intrusion for an attacker to gain widespread access, and it lets the attacker pivot between hosts and services with little obstruction and little chance of detection.

Organizations can build segmentation at several layers: demilitarized zones and gateways between networks with different security requirements, routers or layer 3 switches with access control lists, virtual LANs and virtual routing and forwarding, host-based firewall software, network firewalls, network access controls, and application firewalls and proxies. ASD guidance lists five themes for good implementations: apply controls at more than the network layer, use least privilege and need-to-know, separate hosts and networks by sensitivity or criticality, authenticate and authorize all access, and allow only approved traffic instead of blocking known bad traffic.

Segmentation makes it harder for an attacker to locate and reach sensitive data and makes timely detection of their activity more likely. After an intrusion, it gives responders a way to isolate compromised hosts or networks. It is also used to isolate vulnerable assets that cannot be patched right away. The measures work only if they are planned with care, enforced, monitored closely, and impossible to bypass, and they need adapting after significant network changes.