Network segmentation without breaking your applications

Why flat networks are dangerous

On a flat network, every device can talk to every other device. When an attacker compromises one laptop, printer or camera, they can scan and reach everything else. Segmentation limits that lateral movement, so a single compromised device stays a contained incident.

It also makes compliance easier. Separating payment systems, medical devices or regulated data into their own zones can reduce how much of the network falls into audit scope.

Step 1: Map what actually talks to what

Before writing a single rule, collect flow data from switches and firewalls for a few weeks. You are looking for which systems communicate, on which ports, and how often. This reveals the dependencies nobody wrote down — the backup server that reaches every host, the badge system that talks to HR.

Step 2: Define a small number of zones

Resist the urge to build dozens of segments on day one. A practical starting set might look like this:

Users

Corporate laptops and desktops.

Servers

Data center and on-premises applications.

Management

Network and infrastructure management interfaces.

IoT and building systems

Cameras, printers, HVAC, badge readers.

Guests

Internet only, isolated from everything else.

Sensitive

Payment, clinical or regulated systems that need their own controls.

Step 3: Apply policy in monitor mode

Write rules between zones based on the flows you observed, but set them to log rather than block. Watch the logs for traffic that would have been denied. Each hit is either an attack you’ve just spotted or a dependency you missed — both worth knowing.

Step 4: Enforce in stages

Move one zone at a time from monitor to enforce, starting with the lowest risk, such as guests and IoT. Schedule each change in a maintenance window with a written rollback. Once a zone has been stable for a couple of weeks, move to the next.

Finally, keep the rule base honest. Every rule should have an owner and a reason, and rules should be reviewed at least annually so temporary exceptions don’t become permanent holes.