5.1.5. Network Segmentation

Segmentation Principles:

• Least privilege: Users/devices access only what they need
• Implicit deny: If not explicitly permitted, it's denied
• Zero trust: Verify every request regardless of source

Segmentation Methods:

• VLANs: Logical separation within switches
• Subnets: IP-based separation requiring routing
• Micro-segmentation: Per-workload policies (often software-defined) that control traffic even between workloads on the same VLAN or host—far more granular than VLAN-level rules
• Private VLANs (PVLANs): Add isolation within one VLAN so guests or tenants on it can't reach each other (defined in 3.2.1)

What to Segment:

• Guest: Own VLAN/SSID with firewall rules allowing internet only, never internal resources
• IoT, OT, and medical devices: Often can't be patched quickly (vendor restrictions), so isolate them and allow only the traffic they need
• Unpatchable critical OT: A unidirectional gateway (data diode) is hardware that physically permits traffic in one direction only—data flows out for monitoring, nothing can flow in. A full air gap is stricter but also cuts off that monitoring.