Definition
Network segmentation involves dividing a computer network into smaller subnetworks, or segments, to enhance security and performance. This isolates parts of the network, limiting an attacker's ability to move laterally.How It Works
- 1VLANs (Virtual Local Area Networks): Create separate broadcast domains within a single physical network.
- 2Micro-segmentation: Uses software to create granular segments, often down to individual workloads.
- 3Zero Trust Architecture: Assumes no implicit trust, enforcing strict access controls.
- 4DMZs (Demilitarized Zones): Act as buffers between internal networks and untrusted external networks.
Key Characteristics
- Isolation: Each segment acts independently, preventing unauthorized access.
- Access Control: Policies determine access to each segment.
- Enhanced Security: Reduces the attack surface by limiting lateral movement.
Comparison
| Feature | Network Segmentation | VLANs | DMZs |
|---|---|---|---|
| Logical Division | Yes | Yes | No |
| Physical Division | No | No | Yes |
| Security Focus | High | Medium | High |
Real-World Example
The 2013 Target breach (CVE-2013-3893) showed the risks of poor segmentation. Attackers accessed the network through a vendor and moved to point-of-sale systems.Detection & Prevention
- Regular Audits: Tools like nmap and Burp Suite map and test network boundaries.
- Access Controls: Implement strict policies with tools like OWASP ZAP to monitor access attempts.
- Continuous Monitoring: Use systems that alert on unusual traffic patterns.
Common Misconceptions
- Myth 1: Network segmentation is only for large enterprises.
- Myth 2: Once segmented, a network is secure.
- Myth 3: Segmentation degrades network performance.