Security · Zero Trust & Secure Architecture · 04
Network segmentation
Network segmentation divides the environment into zones so that a compromise in one cannot spread freely to the others: user devices from servers, production from development, operational technology from corporate IT, guest from staff, and sensitive workloads from everything else. It is needed when a flat network means any device can reach any server, when ransomware readiness depends on containment, when a regulation or contract requires isolation of specific data or systems, or when a customer or insurer asks how sensitive systems are separated. The work produces a zone model tied to the data and systems in each zone, the rules that govern traffic between zones, a migration sequence that moves systems without breaking their dependencies, and the verification that the segmentation is real.
Scope
What the review covers.
- Current network topology and the flows that actually occur
- Zone model based on data sensitivity, function and trust
- Inter-zone rules and the business flows that must be allowed
- Dependency discovery so migration does not break applications
- Implementation options: VLANs, firewalls, cloud network controls, micro-segmentation
- Verification testing and ongoing change control
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Zone model | Zones, membership criteria and the rules between them |
| Flow and dependency analysis | What talks to what, and what must keep working |
| Migration plan | Sequenced moves with rollback |
| Verification report | Tested isolation with evidence |
Prerequisites
What we need from you.
- Network diagrams, device configurations and any flow data available
- Application owners who can confirm dependencies
- The obligations that require isolation, if any
Related
Where this sits.
- Zero Trust & Secure Architecture Service
- Security Hub
- Secure remote access Also
- Cloud access controls Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Will segmentation break applications?
Not if dependencies are discovered first. That is why the analysis precedes the migration, and why moves are sequenced with rollback.
Is micro-segmentation required?
Rarely as a first step. Coarse zones with enforced rules stop most lateral movement. Finer segmentation follows where the risk justifies it.
How does this relate to zero trust?
Segmentation limits what a compromised asset can reach; zero trust limits what a compromised identity can reach. Both are part of the architecture.