2.1.4. Network Architecture and Segmentation
💡 First Principle: Network architecture determines how far an attacker can move laterally after gaining initial access — segmentation turns a single compromised host into a contained incident rather than a full network compromise.
A flat network (no segmentation) means an attacker with access to any device can reach every other device. In 2017, NotPetya spread across entire corporate networks in minutes precisely because internal networks had no segmentation. Segmentation creates chokepoints that force lateral movement to cross boundaries — boundaries that can be logged, filtered, and alarmed.
Network segmentation divides networks into zones with different trust levels and controlled communication paths between them. Common segmentation models:
| Zone | Contents | Access Policy |
|---|---|---|
| DMZ | Internet-facing servers (web, email, DNS) | Inbound from internet; limited outbound to internal |
| Corporate LAN | User workstations, internal apps | No direct inbound from internet |
| Server/Data tier | Databases, file servers, domain controllers | Accessible only from specific application servers |
| OT/ICS | Industrial control systems | Isolated from IT network; air-gapped or firewalled |
| Management | Infrastructure management (hypervisors, switches) | Accessible only from jump servers |
Zero Trust takes segmentation logic to its extreme conclusion: no implicit trust based on network location. Every access request — even from a device inside the corporate network — must be authenticated and authorized against policy. Zero Trust implementations typically involve:
- Identity verification for every request (strong MFA)
- Device health checks before access is granted
- Least-privilege access (only the specific resources needed, for the minimum time)
- Continuous monitoring and re-verification
SASE (Secure Access Secure Edge) converges network security and WAN capabilities into a cloud-delivered service — think Zero Trust for users connecting from anywhere, with security policy enforced at the edge rather than at a central data center firewall.
SDN (Software-Defined Networking) separates the control plane (routing decisions) from the data plane (packet forwarding), enabling centralized, programmable network policy. From a security standpoint, SDN enables rapid network reconfiguration during incidents (isolating a compromised segment without touching physical hardware) and micro-segmentation at scale.
⚠️ Exam Trap: Zero Trust is an architectural philosophy, not a single product. When an exam question asks what Zero Trust "does," the answer is about continuous verification and least-privilege — not about any specific technology or vendor.
Reflection Question: An attacker gains access to a developer's workstation in a flat network. In a segmented network with Zero Trust principles applied, what additional steps would they need to complete to access the production database server, and why does each step provide a detection opportunity?
