Segmentation
Definition
Dividing a network (or any system) into zones so a compromise in one zone cannot spread. The foundation of Zero Trust and PCI/HIPAA/OT architectures.
Granularity spectrum
- Perimeter only — trusted/untrusted (legacy)
- Zones — DMZ, internal, management
- Micro-segmentation — per-workload / per-identity
Where it appears
🌐 Networking
- VLAN — L2 segmentation
- VRF — L3 separation on the same device
- ACLs — permit/deny by 5-tuple
- Firewalls — stateful inspection between zones
- NAC — PacketFence vs OpenNAC dynamic VLAN assignment
☁️ Cloud
- AWS — separate VPCs, subnets, Security Groups, NACLs
- Azure — VNets, NSGs, ASGs, Azure Firewall
📦 Containers
- Kubernetes NetworkPolicy — pod-to-pod firewall
- Cilium / Calico — identity-aware policy, eBPF
- Namespaces — logical, not security
🔐 Cybersecurity
- Zero Trust — segment by identity, not network location
- OT/IT separation — Purdue model levels