Architecture
Segmentation & Zones
Group assets into zones by consequence and function, and permit only defined conduits between them.
Defensive guide
Why should I care?
Segmentation limits how far a compromise travels and makes abnormal traffic visible.
How to implement it
- Define zones by process function and consequence, not by convenience
- Document required flows before writing any rules
- Deny by default at every boundary; permit named source/destination/service with a purpose
- Phase deployment: monitor first, then enforce
What good looks like
- Every rule has an owner and a documented purpose
- No any/any rules
- Rules recertified periodically
Common failure modes
- Temporary rules that become permanent
- VLANs without enforcement between them
- Segmentation designed without engineering input
How to verify it
- Test that a host in one zone cannot reach a controller in another
- Review rule bases for unused and overly broad entries