2.1.4. Network Architecture and Segmentation
💡 First Principle: Network architecture determines how far an attacker can move laterally after gaining initial access — segmentation turns a single compromised host into a contained incident rather than a full network compromise.
A flat network (no segmentation) means an attacker with access to any device can reach every other device. In 2017, NotPetya spread across entire corporate networks in minutes precisely because internal networks had no segmentation. Segmentation creates chokepoints that force lateral movement to cross boundaries — boundaries that can be logged, filtered, and alarmed.
Network segmentation divides networks into zones with different trust levels and controlled communication paths between them. Common segmentation models:
| Zone | Contents | Access Policy |
|---|---|---|
| DMZ | Internet-facing servers (web, email, DNS) | Inbound from internet; limited outbound to internal |
| Corporate LAN | User workstations, internal apps | No direct inbound from internet |
| Server/Data tier | Databases, file servers, domain controllers | Accessible only from specific application servers |
| OT/ICS | Industrial control systems | Isolated from IT network; air-gapped or firewalled |
| Management | Infrastructure management (hypervisors, switches) | Accessible only from jump servers |
Enforcing the boundaries. VLANs split broadcast domains at Layer 2; hosts in different VLANs can exchange traffic only through a Layer 3 device (router, Layer 3 switch, or firewall), so traffic crossing a VLAN boundary means a rule permits it, most often a firewall or ACL change made outside change control, or, less often, that something bypasses the boundary (a dual-homed host, VLAN hopping). Check the firewall rule set and change records first. When policy-prohibited cross-zone traffic appears (for example a development host connecting to a production database on TCP 5432), first decide whether it is attacker lateral movement or a misconfiguration, then contain if malicious; blocking blindly can break legitimate work and destroy evidence. An outbound any-to-any allow rule defeats egress control: replace it with explicit allows for required business traffic (default deny), which also removes the open channel a C2 beacon on an odd port such as 4444 relied on.
Private address space (RFC 1918) is 10.0.0.0/8 (the largest block), 172.16.0.0/12, and 192.168.0.0/16; these ranges are not routable on the internet.
Zero Trust takes segmentation logic to its extreme conclusion: no implicit trust based on network location. Every access request — even from a device inside the corporate network — must be authenticated and authorized against policy. Zero Trust implementations typically involve:
- Identity verification for every request (strong MFA)
- Device health checks before access is granted
- Least-privilege access (only the specific resources needed, for the minimum time)
- Continuous monitoring and re-verification
ZTNA / identity-aware proxy is the usual Zero Trust replacement for a flat VPN: instead of putting the user on the network, it grants access to individual applications per request, based on user identity, device posture, and context. A VPN with stronger encryption, MFA, or split tunneling still gives network-level reach.
Legacy and OT systems. Zero Trust is a set of principles, not a requirement that every device hold a certificate. Controllers and other legacy systems that cannot authenticate or run an agent are covered with compensating controls: micro-segment them, allow only the specific source, destination and protocol combinations they need (especially at the IT/OT boundary), and monitor for any deviation. Rip-and-replace is not a precondition (NIST SP 800-207).
SASE (Secure Access Service Edge) converges network security and WAN capabilities into a cloud-delivered service — think Zero Trust for users connecting from anywhere, with security policy enforced at the edge rather than at a central data center firewall.
SDN (Software-Defined Networking) separates the control plane (routing decisions) from the data plane (packet forwarding), enabling centralized, programmable network policy. From a security standpoint, SDN enables rapid network reconfiguration during incidents (isolating a compromised segment without touching physical hardware) and micro-segmentation at scale.
⚠️ Exam Trap: Zero Trust is an architectural philosophy, not a single product. When an exam question asks what Zero Trust "does," the answer is about continuous verification and least-privilege — not about any specific technology or vendor.
Reflection Question: An attacker gains access to a developer's workstation in a flat network. In a segmented network with Zero Trust principles applied, what additional steps would they need to complete to access the production database server, and why does each step provide a detection opportunity?
