Network and segmentation, explained simply
A network is the roads between computers. Security here is about how far someone can travel once they get in.
The big idea
Picture a block of flats where every flat has an internal door to every other flat. If a burglar gets into one, they can walk into all of them. That is a flat network, and many organisations still have one.
Segmentation means locking those internal doors, so getting into one flat does not mean getting into the rest. How far a burglar could get from one break-in is called the blast radius, and making it small is one of the most useful things a security team can do.
A burglar gets in through one laptop. In a flat network every internal door is open, so they can reach all 12 rooms, including the three that matter most.
Pick one to watch the break-in spread. Pick it again to replay.
The trouble is that you cannot decide which doors to lock until you know what each flat is for and who lives there. So the first job is labelling: this one is the payroll system, that one is a test machine, this one belongs to the shop website. With good labels, the rules almost write themselves.
Without labels, each machine is just an address, and every rule says this address may talk to that one. The rules pile up, and nobody can say what they protect.
Pick one to compare.
The network also includes the internet's own plumbing. The address book that turns names like lgkm.org into numbers (DNS), and the post service that carries email, were both built when everyone trusted everyone. Several add-ons since then let you check that an address or a letter really came from who it claims to, though each brings its own ways to go wrong.
Words you will meet
- IP address: the number that says where a computer is on a network, a bit like a street address.
- Segmentation: splitting a network into parts with locked doors between them.
- Microsegmentation: the same idea down to single machines, with a door around each one.
- Blast radius: how far an intruder could get from one break-in.
- Workload: a program or service running somewhere, such as a website or a database.
- DNS: the internet's address book, which turns names into numbers.
- DNSSEC: a seal on the address book's answers, so nobody can forge them.
- SPF, DKIM and DMARC: checks that an email really came from the domain it claims to.
The field notes, in plain words
- DNSSEC: why it exists, who uses it and what it has broken
DNSSEC puts a seal on the internet's address book so nobody can forge an entry, but if the seal is applied wrongly the whole address vanishes.
- Email was built to trust everyone: TLS, SPF, DKIM and DMARC, and what each one breaks
Email was built so anyone could sign a letter with any name; several add-ons now check the sender owns the address, but none can tell if they are honest.
- IP address or identity: what should actually let someone in?
Where a knock on the door comes from is a clue, not proof; who is knocking matters more, and the fence just makes the gate easier to guard.
- Blast radius belongs in the board pack
Boards should ask one simple question: if a burglar gets into one room, how many of the important rooms can they reach?
- Labels before rules: why microsegmentation projects stall
Before you can build walls between rooms, you have to know what each room is for, so name things first and the rules get simple.
Ready for more? Network and segmentation: where things stand
Personal work and my own view, not my employer's. Sources are public.