Insights · Field note · Security assurance and compliance
Network segmentation without disrupting operations
A flat network lets one compromised workstation reach everything. Segmenting it is a sequence of observed, tested, reversible steps.
Network segmentation divides the environment into zones with controlled traffic between them so that a compromise is contained. The fear is disruption: something nobody knew about stops working. The method that avoids it is observation first: map what actually talks to what, over weeks, before writing a rule; then segment in stages, starting with the highest-value separation (workstations from servers and backups, operational technology from business systems), with rules in monitor mode before enforcement, a rollback for every change and a window agreed with operations. Segmentation done this way is slower than a weekend cutover and does not break the plant.
In detail
What the evidence shows.
Observe before you block
Flow logs, switch telemetry or a passive sensor record real traffic between systems over a representative period including month-end and maintenance. The map shows dependencies nobody documented: the application that calls a database on another subnet, the backup agent, the printer, the vendor connection. Rules written without the map break them.
Order of separation
Backups from everything, so a compromise cannot delete them. Workstations from servers, so a phished laptop cannot reach the domain controller. Operational technology, medical devices and other unpatchable systems from the business network. Administrative access through a controlled path. Each step contains the attack most likely in that environment.
Monitor, then enforce
New rules run in monitor mode: they log what they would have blocked. Violations are investigated and either allowed deliberately or confirmed as unwanted. Only then is enforcement turned on, in a window, with rollback ready. Disruption is caught as a log entry rather than as an outage.
Keep it
Segmentation decays as systems are added without rules. Change control includes the zone model; the map is refreshed on a schedule; validation tests that the segments still hold. See network segmentation, NIST SP 800-207 for the architecture principles, and the glossary entry for network segmentation.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days