Network segmentation

What it means

Network segmentation divides a company network into separate zones, for example for office PCs, servers, guest Wi-Fi, printers or production equipment, with controlled traffic between them. An attacker who breaks into one zone cannot reach everything else.

Without segmentation, a company network is like a house without internal doors: whoever gets through the front door can enter every room. In a ransomware attack, malicious code spreads quickly across a flat network to every device, backups included.

Segmentation is implemented with virtual networks, firewalls and rules defining which traffic between zones is allowed. It applies the principle of least privilege at network level and is part of the zero trust approach.

How it works in practice

Even a small company should at least separate guest Wi-Fi from the work network and keep IoT devices such as cameras or smart thermostats away from computers holding accounting data. Such devices often have weak security and are a frequent entry point for attacks.

Servers with sensitive data and backups belong in a separate zone that can be reached only from specific devices and for specific services. Employees' remote access goes through a VPN with authentication and only into the zones they need.

For companies covered by NIS2, segmentation is among the expected technical measures. During design, map which systems communicate with each other so that the rules do not disrupt normal operations.

What to watch out for

Segmentation with exceptions for everything offers no protection. If a new rule is opened every time a technical obstacle appears, the network gradually becomes flat again. Rules should be documented and reviewed regularly.

Changing network architecture can unexpectedly break services such as printing, scan-to-folder or the link between accounting software and the bank. Changes should therefore be rolled out gradually, with testing and a rollback plan.