Network Architecture and Segmentation

Network architecture and segmentation. This lesson is about a common failure: a hard shell around a soft centre, and how to correct it.

The scene. The organisation has invested heavily in its perimeter: a strong firewall, monitored gateway, the works. Inside, though, the network is flat, every server, workstation and printer sits in one zone with nothing between them. When a single laptop is compromised by a phishing email, the attacker finds they can reach the finance servers, the domain controller and the backups directly, because once you are inside, there are no more walls.

Good network security is built in layers, defence in depth, so that no single control is the only thing standing between an attacker and everything. A strong perimeter is one layer, but if it is the only layer, breaching it once, or a malicious insider starting inside, means unrestricted access. The flat internal network is exactly that failure.

Segmentation divides the internal network into zones with controlled boundaries between them, so traffic between zones is filtered and a compromise in one cannot spread freely to the others. It limits lateral movement: the attacker who lands on a laptop is confined, not handed the finance servers and the domain controller. This is the containment principle from least privilege, applied to the network.

So picture the difference. A flat network is one zone with no internal walls: a foothold reaches everything, and the attacker moves freely. A segmented network has zones with filtered boundaries: a breach is bounded, and movement hits a wall. Had the network in the scenario been segmented, the compromised laptop would have hit a boundary long before the backups.

A specific, heavily tested piece of architecture is the D-M-Z, the demilitarised zone: a buffer zone between the internet and the internal network where internet-facing servers, web, mail, public applications, are placed. They must be reachable from the internet, which makes them exposed, so isolating them in the D-M-Z means compromising one does not directly reach the internal network.

And the exam’s trap here is to suggest the D-M-Z is where sensitive data lives. It is the opposite. The most sensitive data belongs deep inside, and the D-M-Z holds only what must be exposed, kept away from everything that must not.

The flat-network failure reflects an old assumption: that being inside the network means being trusted. Zero trust discards that. Its principle is that no user or device is trusted based on network location; every request is authenticated, authorised and verified on its own merits, wherever it comes from.

Why. Because attackers breach perimeters and insiders are already inside, so network position is treated as no evidence of trustworthiness at all. Zero trust replaces inside equals safe with continuous verification. It is the modern answer to the soft-centre problem.

Together, segmentation and zero trust fix the hard-shell, soft-centre network. Segmentation ensures even a trusted-looking foothold cannot roam the whole network, and zero trust verifies every request regardless of origin.

And the benefit to name is limiting the blast radius. When a question asks the security benefit of segmentation, it is containing a compromise, so one breach does not become total, not making the network faster and not reducing the device count.

So carry this away. A strong perimeter around a flat internal network means one compromise reaches everything, which is why segmentation and defence in depth exist. Segmentation contains the breach, the D-M-Z isolates the internet-facing servers, and zero trust refuses to trust anything based on its network location.