Network Segmentation

Flat Network (Unsegmented):
┌─────────────────────────────────────────────┐
│  Same Broadcast Domain / Same Subnet         │
│                                               │
│  [Web Server]───[Database]───[HR System]      │
│       │             │            │            │
│  [Printer]────[Employee PC]──[CEO Laptop]     │
│       │             │            │            │
│  [Guest WiFi]───[IoT Device]──[AD Server]    │
└─────────────────────────────────────────────┘
  ❌ If any device is compromised → attacker can reach everything

Segmented Network:
┌─────────┐  ┌──────────┐  ┌────────────┐
│ Public   │  │ Private  │  │ Management │
│ (DMZ)    │  │ (Internal)│ │ (Admin)    │
├─────────┤  ├──────────┤  ├────────────┤
│ Web     │  │ Database │  │ AD Domain  │
│ Server 1│  │ Primary  │  │ Controller │
│ Web     │  │ App      │  │ Jump Box   │
│ Server 2│  │ Servers  │  │ SIEM       │
└────┬────┘  └────┬─────┘  └─────┬──────┘
     │            │              │
     └─────Firewall──────────────┘
         (inspect, filter, log)
  ✅ Compromise in DMZ → attacker cannot reach database

# Kubernetes Network Policy — Micro-segmentation example
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-isolation
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: api-server
      ports:
        - protocol: TCP
          port: 5432
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: api-server
      ports:
        - protocol: TCP
          port: 443

Pre-Breach:
  └─ Target has a network for POS (payment) systems
  └─ Target has a network for HVAC (heating/cooling) systems
  └─ These networks are NOT segmented — systems can communicate freely

September 2013:
  └─ Attackers compromise Fazio Mechanical (Target's HVAC vendor)
  └─ Phishing email sent to Fazio employee
  └─ Malware installed on Fazio's systems
  └─ Fazio had remote access to Target's network for HVAC monitoring

October 2013:
  └─ Attackers use Fazio's remote access to enter Target's network
  └─ From the HVAC segment, attackers move laterally to POS segment
  └─ NO FIREWALL between HVAC and POS — no chokepoint
  └─ Attackers deploy RAM-scraping malware on POS terminals

November-December 2013:
  └─ 40 million credit card numbers stolen
  └─ 70 million customer records exfiltrated
  └─ Data exfiltrated via FTP from POS segment to external servers
  └─ NO EGRESS FILTERING — POS systems could send data to the internet

December 2013:
  └─ US Department of Justice alerts Target
  └─ Breach disclosed
  └─ Stock drops 46%
  └─ CEO resigns
  └─ $300M+ in settlements, legal fees, remediation

  HVAC Vendor ───→ HVAC Network ───→ [FIREWALL] ───→ POS Network
                      │                    │              │
                  (Compromised)          BLOCKED      (Protected)

  Result: Attacker confined to HVAC segment
  POS data remains protected
  Breach prevented or drastically limited

1. All resources are private — no public IPs
2. Access is granted per-connection, not per-network
3. User identity + device posture verified for every request
4. Least privilege — only what's needed, nothing more
5. All traffic is inspected (no implicit trust)
6. Continuous verification (not just at login)

Minimum Segmentation Standards (Any Organisation):

Tier 1 — Critical (MANDATORY):
  └─ Separate VLAN for all servers vs. endpoints
  └─ DMZ for internet-facing services
  └─ PCI DSS cardholder data environment isolated
  └─ Management network (OOB management)

Tier 2 — Strongly Recommended:
  └─ Separate voice/video VLAN
  └─ Guest WiFi on isolated VLAN with internet-only access
  └─ IoT/OT devices on separate network
  └─ Database servers on their own segment

Tier 3 — Advanced (Mature Organisations):
  └─ Micro-segmentation per application tier
  └─ Zero Trust architecture
  └─ Automated policy enforcement (CSP)
  └─ Dynamic segmentation based on user/device risk