Network Segmentation Explained for Cybersecurity Beginners

Start with the resource and the necessary flow

List the resource you want to protect and the legitimate work that depends on it. Identify source, destination, service, owner and reason for access. “Users need the database” is too broad; an application may need a specific database service while user devices should reach only the application.

A useful small design separates business requirements from implementation. First write the allowed relationships in plain language. Then decide where enforcement belongs and which observations would prove it works. Do not begin by copying rules from an unrelated environment.

Understand what a VLAN does and does not do

A VLAN separates a logical layer-2 broadcast domain. Communication between VLANs can still be routed by a device with permission to do so. Creating different VLAN names or subnet ranges does not automatically enforce a security policy on that routed traffic.

In a synthetic office, guest, staff and server networks may be different VLANs. If the routing policy allows any source to any destination, the guest boundary still fails its intended purpose. You need to inspect the enforcement path and rules, not just the labels on the diagram.

Use ACLs and least privilege deliberately

An access-control list expresses permitted or denied traffic at an enforcement point. Rule order, direction, protocol, ports and the behaviour of the device all matter. Document the intended result instead of assuming that a rule copied to one interface controls every path.

Least privilege means enabling the access necessary for the authorised task while limiting unnecessary access. Include supporting services, management requirements and a recovery plan in the review. An overbroad emergency exception should have an owner, reason and review point.

Distinguish segmentation from Zero Trust

Segmentation can limit paths and reduce the scope of an incident. Zero Trust is broader: access decisions should not rely only on being inside a network. Identity, device context, resource policy and the requested action still matter.

A device in a staff VLAN is not automatically authorised to every staff resource. Conversely, a legitimate remote user may need tightly controlled access to one service. Describe the access decision around the protected resource, rather than treating an internal address as proof of trust.

Review identity and access control →

Consider cloud identity boundaries →

Validate both positive and negative cases

A positive test asks whether an approved dependency works. A negative test asks whether an explicitly prohibited path is refused. Both are necessary: blocking everything can appear secure while breaking the service, and a successful application test says nothing about unwanted guest access.

In an authorised lab, define the expected result before testing and record source, destination, service, time and evidence. If the result differs, inspect the actual path and enforcement point. Do not add a broad allow rule simply to make the test green.

• Confirm the documented application flow succeeds.
• Confirm a guest or unrelated source is denied the protected service.
• Check the approved administrator path remains usable.
• Record a rollback plan before any authorised change.
• Repeat the relevant checks after a rule or dependency changes.

Turn the review into a defensible recommendation

Write down the exposure, the intended boundary, the smallest proposed policy change and how it will be validated. Include uncertainty such as an undocumented dependency or an unverified alternate path. Ask the owner for that missing context before recommending a production change.

The released Pro segmentation lab uses a fictional network and evidence packet with worked reviews. It is a place to practise interpreting rules and explaining tradeoffs, not an invitation to scan or exploit a real network. The existing free lesson and quiz remain available without a membership.

Take the free segmentation quiz →

Explore the segmentation review lab →