Network segmentation and Zero Trust

Map the flows before writing rules

List the applications, users, devices and services that need to communicate. Record the purpose, protocol and owner for each flow. Separate guest access, ordinary workstations, administration, servers and recovery systems where appropriate. A VLAN name alone is not proof of isolation; routing and filtering determine which traffic actually passes.

Allow required access, review exceptions

Use explicit rules based on business need. Administrative access should take a controlled route with strong identity and device requirements. Exceptions need an owner and an expiry or review date. Avoid a broad allow rule that quietly reconnects every segment.

Validate from representative locations

Use authorised tests to confirm required applications work and prohibited paths fail. Review logs and packet evidence within the agreed scope. Account for dependencies such as DNS and time services. Zero Trust is an approach to continually evaluating access, not a product label or the assumption that an internal address is trustworthy.

Common mistakes

• Assuming VLANs automatically block routing
• Trusting every internal device
• Creating permanent unowned exceptions

Your practical checklist

Checklist ticks are temporary and are not recorded as account progress.