Network Segmentation That Contains an Intrusion

Most intrusions start small: one phished user, one exposed service, one unpatched device. What turns a small foothold into an organization-wide incident is usually the network itself. When every system can talk to every other system, an attacker who lands on a single workstation can scan, move laterally and reach file servers, domain controllers and backup systems without crossing a single meaningful boundary.

Segmentation does not stop the first compromise. It limits how far that compromise can spread, and it gives defenders more chances to notice it.

Why flat networks are dangerous

Many networks grew one subnet at a time, with routing between everything and firewalls only at the internet edge. In that design:

• Lateral movement is easy. Remote administration protocols, file sharing and remote desktop work from any host to any host.
• Sensitive systems are exposed to ordinary endpoints. A user laptop can reach database ports and hypervisor consoles it never needs.
• Detection is harder. With no internal choke points, there are few places to watch traffic or spot unusual connections.
• Scope is hard to define. When everything is connected, assessors and responders must assume everything is in scope.

Segment by function and sensitivity

Start by grouping systems according to what they do and what they hold, not where they happen to sit. Common zones include user workstations, servers by role, identity infrastructure, security tooling, backup systems, operational technology, guest and IoT devices, and internet-facing services.

For each zone, write down the traffic it genuinely needs: which zones it must reach, on which ports, and why. Everything else is denied by default. This flow inventory is the real work of segmentation, and it is often where organizations discover dependencies no one documented.

Workstations should rarely talk to each other. Peer-to-peer traffic between user devices is a common path for lateral movement and is seldom needed for business purposes. Blocking it with host firewalls or network controls removes a large amount of attacker freedom at low cost.

Enclaves for CUI and other sensitive data

Organizations that handle Controlled Unclassified Information often find that protecting the entire network to NIST SP 800-171 is expensive and slow. A well-defined enclave can reduce the scope: CUI is stored and processed only within a segmented environment that has its own access controls, monitoring and boundary protections.

An enclave only reduces scope if the boundary is real. That means:

• Clear entry points, such as a dedicated virtual desktop or jump host, rather than broad routing from the corporate network.
• Separate administration, so that compromising corporate administrator accounts does not grant control of the enclave.
• Controlled data movement, with documented ways CUI enters and leaves the enclave.
• Documentation that shows assessors exactly where the boundary is and how it is enforced.

Control east-west traffic

Traditional firewalls inspect north-south traffic between the network and the internet. Attackers inside the network move east-west, between internal systems. Options for controlling that traffic include internal firewalls between zones, access control lists on core switches, host-based firewalls managed centrally, and microsegmentation tools that enforce policy per workload in virtualized and cloud environments.

Whichever approach you choose, log allowed and denied flows between zones. Denied connections from a workstation to a server zone it has never needed are a useful early warning.

Build a separate management network

Switch, firewall, hypervisor, storage and out-of-band server management interfaces should not be reachable from user networks. Place them on a dedicated management network, reachable only from hardened administrative workstations or jump hosts, with phishing-resistant MFA and separate administrator accounts. An attacker who reaches management interfaces can often undo every other control.

Test that segmentation holds

Segmentation rules drift. Temporary exceptions become permanent, new applications open new paths and cloud connections bypass on-premises firewalls. Verify regularly:

• Scan from each zone toward the others and compare what is reachable with what the policy says should be.
• Review firewall rules for broad "any" entries, expired exceptions and rules no one can explain.
• Include segmentation in penetration testing, starting from a compromised workstation rather than only the internet edge.
• Retest after major network, cloud or application changes.

Frequently asked questions

Is VLAN separation enough? Not on its own. VLANs separate broadcast domains, but if routing between them is unrestricted, they provide little protection. Pair them with filtering between zones.

Does segmentation apply in the cloud? Yes. Virtual networks, security groups and identity-based policies serve the same purpose and need the same flow inventory and review.

Where should we start? Protect identity infrastructure, backups and management interfaces first, then block workstation-to-workstation traffic.

How CDT can help

CDT's secure architecture engineers design segmented networks and CUI enclaves that hold up to assessment, and our red team tests whether an attacker inside your network could cross the boundaries you rely on.