Network Segmentation

Problem

An attacker compromises one employee laptop. If every internal machine can freely communicate with every server, one compromise can spread throughout the organization.

Solution — Segmentation

Divide the network into controlled security zones. Zones can be subnets, VLANs, or separate virtual networks. Firewall rules or Azure network security groups (NSGs) enforce which traffic may pass between them.

Users → Apps → Databases
Users → Databases: blocked

Traffic between zones follows explicit rules.

Core idea: segmentation limits how far network access and compromise can spread.