Network Segmentation.

What Is Network Segmentation?

Network segmentation means dividing a network into smaller segments and controlling what can pass between them. CISA recommends separating sensitive information into distinct zones, so that sensitive systems sit apart from everyday user machines.

How Do You Divide a Network?

CISA describes two ways to do it. Physical separation uses traditional devices such as routers. Virtual separation uses private VLANs and virtual routing and forwarding (VRF), which give logical isolation on shared equipment. NSA and CISA also recommend next-generation firewalls, engineering segments to isolate critical systems, and properly configured access control lists, DMZs and, in virtualized environments, micro-segmentation.

CISA advises applying least privilege when designing the segments. In plain terms, a segment should only be reachable by those who have a reason to use it.

A simple illustration: a network where office computers, production systems and critical systems each sit in their own segment, with rules deciding what may talk to what.

What Does a Flat Network Cost You?

CISA says proper segmentation is an effective mechanism to prevent an intruder from propagating exploits or moving laterally inside an internal network. NSA and CISA also list lack of network segmentation among the most common misconfigurations, noting it leaves no security boundaries between user, production and critical system networks. So one compromised machine in a flat network can often reach far more than it should.

Server management controllers are one example. In October 2026 Supermicro fixed IPMI flaws in its BMC firmware, and runZero’s researchers advise limiting BMC access to trusted addresses, a VPN or a dedicated management network. Our explainer on the Supermicro BMC session ID flaw shows why that matters. Segmentation decides who can reach a management server at all. When a flaw needs no login, as with the Quest Foglight missing authentication flaw CVE-2026-92188, that reach is the only barrier left.

Which Attacker Techniques Does Segmentation Address?

MITRE lists network segmentation as a mitigation for many techniques. Six examples follow.

How Do You Check a Segmented Network?

• Separate user, production and critical system networks.
• Place firewalls and access control lists between the segments.
• Use VLANs or other virtual separation where physical separation is not practical.
• Design each segment with least privilege in mind, and consider host-based firewall rules that deny traffic from other hosts.
• Monitor and maintain the segments. NSA and CISA say assessment teams found supposedly air-gapped OT networks reachable through forgotten or accidental connections to IT systems.

Is Network Segmentation the Same as Zero Trust?

No. Segmentation is one technical control. Zero trust is a wider approach to access. The two are often discussed together, but they are not the same thing.

Is Network Segmentation the Same as a Firewall?

No. A firewall is one tool used to enforce the rules between segments. Segmentation is the design of the segments themselves.

Terms Close to Segmentation

See also lateral movement, zero trust, attack surface and least privilege, which limits what each account can reach.

Related Pages in the Knowledge Hub

• Attack surface reduction
• Remote Services
• Misconfiguration detection

Sources

• CISA: CISA on segmentation: containing intruders, least privilege, physical and virtual separation.
• CISA: NSA and CISA name lack of network segmentation as a top misconfiguration and recommend firewalls, VLANs and ACLs.
• MITRE ATT&CK: M1030 Network Segmentation: measures and the techniques it addresses.