5.1.5. Network Segmentation

Segmentation Principles:

• Least privilege: Users/devices access only what they need
• Implicit deny: If not explicitly permitted, it's denied
• Zero trust: Verify every request regardless of source

Segmentation Methods:

• VLANs: Logical separation within switches
• Subnets: IP-based separation requiring routing
• Micro-segmentation: Per-workload isolation (often software-defined)