Network Segmentation Explained: Key Concepts and Benefits 

Understanding Network Segmentation 

Network segmentation is a cyber security strategy that involves dividing a large network into smaller, isolated segments or subnets. This division limits the potential damage that a successful cyber attack can inflict. By compartmentalising the network, organisations can reduce the attack surface and prevent malicious actors from spreading laterally. 

Why does Network Segmentation Matter? 

1. Containment of Threats: If a threat actor breaches a segmented network, their ability to move laterally and access critical systems is significantly reduced. This containment strategy limits the potential damage. 
2. Enhanced Security Posture: By segmenting the network, organisations can implement more granular security policies, such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS), tailored to each subnetwork’s specific needs. 
3. Improved Performance: Segmenting a network can optimise network traffic flow, leading to better performance and reduced latency. 

Types of Network Segmentation 

Organisations have a range of options available to them regarding network segmentation, ranging in complexity and technology. Whilst network segmentation has been available to organisations for many years, Data Connect network engineers and security consultants still come across many networks that aren’t effectively segmented. Planning and effective implementations are key to its success. 

Some use cases for network segmentation include guest wireless network, PCI DSS compliance, geographical location, IoT devices, public cloud security and user group access.  

There are many ways to segment a network.  Below, we have outlined two viable examples for an organisation.  

Basic Secure Network Design: 

Our team have been discussing network segmentation with customers for 20+ years and one of the original purposes was to segment broadcast domains. With a vast number of devices on a single logical network, old switches and routers would have to process loads of unnecessary chatter from connected devices on the same segment.​ 

The easiest way to do this was to use VLANs. A VLAN is a logical overlay network that groups together a subset of devices that share a physical LAN, isolating the traffic for each unique VLAN. Each VLAN should be tied to one unique IP address range. A common mistake our network engineers have seen which negates some of the benefits of VLAN segmentation is having multiple ranges on the same VLAN.  

A common example of this type of segmentation is putting users in one VLAN and putting the services they need to access in another VLAN. 

Whilst this may sound odd, as we are moving resources away from the people who need to use them, but actually we’re putting them into containers which gives you the opportunity to start thinking about access controls.​ 

If you don’t put access controls (and many don’t) between your VLANs then you’ve done very little to reduce the overall attack surface, after all a router will route attacks between VLANs. ​ 

If you’re using routers or Layer 3 switches then you can get some control by using simple access lists, however problems arise due to basic functionality and difficulty of management. If you are wanting to modernise and improve your approach to network security, this method isn’t sufficient.  

Firewalls for Secure Network Design 

Using the same example as above, we have now inserted NGFWs into the network segmentation to route between networks or VLANs. ​ 

Next-Generation Firewalls (NGFWs) are advanced security solutions that go beyond traditional firewalls to protect networks from modern cyber threats. By combining multiple security features like deep packet inspection, intrusion prevention systems, application control, user identity awareness, and cloud-based threat intelligence, NGFWs offer comprehensive protection. They enhance network visibility, control, and security, often supporting Zero-Trust security models. By consolidating disparate security functions into a single solution, NGFWs simplify security management and reduce costs.  

​Now with Next-Generation Firewalls present, you can identity users and create policies around their access requirements. Other components can also now be layered in, like looking at applications, applying security profiles, monitoring traffic flow and making changes according to real-time information.​ 

Before implementation, customers often have common concerns including worrying about performance and potential operational/service impact. After discussions with our experienced and certified network engineers, their worries are often put to rest. Whilst a firewall (or any device) could become a bottleneck for performance, a correctly spec’d, modern NGFW is more than capable of processing high volumes of traffic. Thanks to advancements in chip technology this is even true for many of the low end models these days. In terms of operational impact, we recommend a phased implementation as you move towards Zero Trust, ensuring new access rules are working prior to migrating all users.  

By using NGFWs in this way, you are using them for exactly what they’re designed to do. It allows utilisation of all the features offered by these platforms, which have been specifically designed to protect against network-based cyber attacks. 

Zero Trust 

Zero Trust is a word you’ve probably heard or seen online as it is very much a buzzword right now. But, there is a good reason for it as it is an effective way of dramatically reducing your cyber risk. Plus, it’s the next logical step after network segmentation with NGFWs, as it takes a more granular approach to security. While NGFWs segment networks to limit lateral movement, Zero Trust challenges the implicit trust of devices and users accessing the network. By continuously verifying and authorising each user and device, regardless of their location, Zero Trust minimises the impact of breaches and strengthens overall security. This approach, often implemented in conjunction with NGFWs, provides a robust defence against sophisticated cyber threats. 

Data Connect offers end-to-end cyber security services and network security is a big part of that. We have a certified team that are highly knowledgeable with a lot of practical experience working with businesses of all sizes and industries.  

Find out more about our services including network security and firewall management.  

Want to learn more about modern network design? Watch “A Guide to Modern Network Security Through Zero Trust and SASE” now.