Topic 3.3 Notes – Protecting Networks: Segmentation
What Network Segmentation Is
Network segmentation means dividing a network into smaller sections so devices are not all exposed to each other in the same way. This is a defense in depth idea. You assume one device might get compromised, then you design the network so that one problem does not become everyone's problem.
A flat network is riskier because it makes lateral movement easier. That means an attacker gets into one device, then moves to other devices on the same local network.
Think of the core contrast like this:
- Same segment
Devices can usually communicate more directly. They also share more local exposure. - Different segments
Traffic has to cross a boundary, and that boundary is where routers, switches, and firewalls can enforce rules.
Segmentation improves security by:
- reducing the blast radius of a breach
- isolating local and broadcast traffic
- allowing different security levels for different systems
The diagram below shows that idea in practice. Traffic from the internet has to pass one firewall to reach the DMZ, and a second, stricter firewall to reach the internal network.
Screened subnet (DMZ) between two firewalls
The Main Segmentation Techniques
You are responsible for four techniques here. They solve different problems, so the exam may ask you to match the control to the need.
Screened subnets and DMZs
A screened subnet, also called a DMZ, sits between the internet and the private internal network. It usually holds public-facing systems such as:
- a web server
- a public DNS server
- another service that must accept outside connections
The DMZ is a lower-trust zone than the internal network. That does not mean unprotected. It still has firewall controls.
The security idea is simple. If a public web server gets compromised, the attacker lands in the DMZ instead of automatically landing inside the private network.
A common example:
- public website server in the DMZ
- payroll server in the internal network
Subnetting
Subnetting divides a larger IP network into smaller IP subnets.
- Devices in the same subnet usually communicate locally.
- Traffic between different subnets must be routed.
That routing point matters because it becomes a place to control traffic. If an employee laptop is compromised, subnetting can keep the attacker initially limited to the employee subnet instead of exposing finance or building systems immediately.
VLANs
A VLAN is a logical network segment created by switches.
The distinction students mix up a lot:
| Term | Created by | Based on |
|---|---|---|
| VLAN | switches | logical separation on shared switching hardware |
| Subnet | IP addressing | network-layer addressing |
Devices can be plugged into the same physical switch and still be in different VLANs. That is the whole point.
Common setup:
- guest Wi-Fi VLAN
- employee VLAN
- server VLAN
Traffic inside one VLAN stays local. Traffic between VLANs must be routed, which creates another control point.
Port security
Port security limits how many MAC addresses a switch port can learn.
Its job here is to help prevent MAC flooding. For example, a wall jack meant for one computer may be limited to one MAC address. If one device starts claiming many addresses, the switch can reject that behavior or disable the port.
Port security supports protection, but it does not create a subnet or VLAN.
How Segmentation Improves Security
Segmentation only helps if traffic between segments is actually controlled. If every segment can freely talk to every other segment, you organized the network without gaining much security.
The main security effects are:
- Containment
One compromised device exposes fewer other devices. - Traffic isolation
Broadcasts, floods, or local attacks affect fewer systems. - Different policies for different zones
Guest devices can reach the internet, but not internal servers. Public servers can accept outside traffic, but payroll systems should not.
This gets tested a lot in scenario questions. The best wording is that segmentation limits exposure and restricts lateral movement. It does not eliminate compromise.
How to Match the Control to the Need
Use the control that fits the situation:
- DMZ for a system that must be reachable from the internet but separated from internal systems
- Subnetting for separate IP networks with routed boundaries
- VLANs for logical separation on shared switches
- Port security for limiting MAC addresses on a switch port and reducing MAC flooding risk
Key Takeaways
Network Segmentation
Dividing a network into smaller, isolated segments or subnets to contain compromises, isolate traffic, and apply different security controls
Flat Network
A network that places many devices in one segment with few internal boundaries, making broad access and attack spread easier after a compromise
Lateral Movement
Using access to one compromised device to reach additional devices, accounts, or resources
Screened Subnet / Demilitarized Zone (DMZ)
A typically lower-security segment between a public network and a private internal network that usually holds public-facing resources behind firewall-controlled boundaries
Subnetting
Dividing an IP network into smaller subnets based on IP addressing so intersubnet traffic must be routed and can be controlled
Virtual Local Area Network (VLAN)
A logical network segment created by switches that separates devices using shared physical switching infrastructure
Port Security
A switch control that limits the number of MAC addresses assignable to a physical port, helping prevent MAC flooding
Higher-Security Zone vs. Lower-Security Zone
A higher-security zone has more restrictive controls for sensitive or critical systems; a lower-security zone is less trusted and accepts greater exposure but remains protected
Notes
Network Segmentation
Dividing a network into smaller, isolated segments or subnets to contain compromises, isolate traffic, and apply different security controls
Flat Network
A network that places many devices in one segment with few internal boundaries, making broad access and attack spread easier after a compromise
Lateral Movement
Using access to one compromised device to reach additional devices, accounts, or resources
Screened Subnet / Demilitarized Zone (DMZ)
A typically lower-security segment between a public network and a private internal network that usually holds public-facing resources behind firewall-controlled boundaries
Subnetting
Dividing an IP network into smaller subnets based on IP addressing so intersubnet traffic must be routed and can be controlled
Virtual Local Area Network (VLAN)
A logical network segment created by switches that separates devices using shared physical switching infrastructure
Port Security
A switch control that limits the number of MAC addresses assignable to a physical port, helping prevent MAC flooding
Higher-Security Zone vs. Lower-Security Zone
A higher-security zone has more restrictive controls for sensitive or critical systems; a lower-security zone is less trusted and accepts greater exposure but remains protected
