Varonis announces strategic partnership with Microsoft to accelerate the secure adoption of Copilot.

Learn more

What Is Network Segmentation?

Network segmentation is the act of dividing a computer network into smaller physical or logical components in order to increase security and protect data.
Robert Grimmick
4 min read
Published January 5, 2021
Last updated February 25, 2022

Simply put, network segmentation is the act of dividing a computer network into smaller physical or logical components.

Two devices on the same network segment can talk to each other directly. For communication to happen with devices on a different segment, traffic must flow through an external demarcation point (typically a router or firewall). This provides an opportunity for traffic to be inspected or security policies to be applied, increasing overall security.

Network segmentation is one of the best mitigations against data breaches, ransomware infections, and other types of cybersecurity threats. In a properly segmented network, groups of end devices like servers and workstations have only the connectivity required for legitimate business use. This limits the ability of ransomware to spread or an attacker to pivot from system to system.

Yet far too many organizations operate an unsegmented or “flat” network. Which is why  we’re now going to explore:

How Is Network Segmentation Implemented?

an overview of traditional approaches to network segmentation that includes VLAN and subnets

There are many ways to effectively segment a network, but Virtual LANs (VLANs) and subnets have traditionally been the most popular.

  • A VLAN is a logical construct that separates traffic at the switch level.
  • Subnets, on the other hand, operate at the IP address and router level.

The two are frequently used together in a one-to-one fashion.

There are many different approaches to network segmentation design. It’s common for companies to section off portions of a network by business department, assigning different VLANs to finance, engineering, and so forth. Traffic between departments can then be inspected or restricted based on business requirements. Access to an internal HR database, for example, could be limited to only those devices on the HR subnet or VLAN.

Another common approach involves deploying different zones with varying security requirements. Servers and databases, for example, are commonly placed into a “demilitarized zone” (DMZ) with much stronger security measures than other parts of the network. This can prevent a malware infection on a company workstation from spreading to servers hosting critical data.

Want more insight into data security trends? Download our in-depth data breach statistics report.

Segmentation can also be based on device type. IoT devices are commonly placed on their own network partition to increase security. In a healthcare setting, for example, X-Ray machines and other connected medical devices might be kept separate from the rest of the network. Different approaches to segmentation can be mixed and matched, depending on technical and business requirements.

What Are The Benefits of Network Segmentation?

an annotation of how network segmentation stops later cyberattacks

The design of a network plays a key role in how effectively an organization can defend against, identify, and recover from security incidents. Statistics on data breaches show that threat actors have become adept at breaching the “perimeter” of a network where defenses are traditionally located. A well-compartmentalized network comprising isolated network segments can limit the ability of an attacker to move laterally and “pivot” from system to system.

To understand the risks of an unsegmented or flat network, we can look at the real-world example of Target’s 2013 data breach.

According to news reports (KrebsOnSecurity), the breach began when an employee at a refrigeration contractor used by Target fell for a phishing email. After compromising the contractor’s systems, the attackers went after a vendor management portal Target used to handle third-party invoicing.

From here, they were able to move laterally through Target’s internal network, eventually managing to install malware on point-of-sale (POS) terminals throughout the company’s stores. In the wake of the attack, Target implemented enhanced segmentation to prevent the kinds of lateral movement that attackers took advantage of.

Effective network segmentation can also make it easier to spot signs of an attack. It’s not uncommon for a company’s Intrusion Detection System (IDS) to generate so many alerts that many go uninvestigated.

By concentrating resources in more sensitive portions of the network, security teams can prioritize incidents likely to have the biggest impact to the organization. Traffic flows between different network segments can also be monitored for patterns, with unusual activity potentially indicating an attack.

Who Needs Network Segmentation?

Organizations of all types and sizes can benefit from a well-designed network, but good segmentation is especially important in certain industries.

  • Healthcare providers: Healthcare organizations must take care to safeguard sensitive patient data, and so may choose to carve out high-security slices of their network to store medical records.
  • Retailers: PCI network segmentation is important for retailers and involves strictly controlling access to parts of the network where cardholder data is processed.

Another common use case for network segmentation is to provide access to guests or visitors. The traffic from the guest VLAN or subnet is kept separate from the rest of the corporate network, ensuring visitors can’t access company data.

Network Segmentation Challenges and New Approaches

an overview of two new approaches to network segmentation that includes microsegmentation and SDN

The traditional approach to network segmentation – dividing the network into VLANs and subnets – requires a great deal of manual effort and doesn’t scale well.

Network architects must carefully decide which resources belong on the same network segment, and come up with appropriate security policies to govern communication between segments. Engineers must then program all of the impacted switches, routers, and firewalls, a painstaking and often error-prone process. In complex environments that have existed for years, implementing network segmentation best practices may be impossible without disrupting business operations.

To address these issues, IT leaders are turning to new approaches like microsegmentation and software-defined networking (SDN). These approaches decouple the enforcement of segmentation policies from the physical network infrastructure, allowing more granular control and easier administration.

  • Microsegmentation allows control of network traffic down to the application or workload level.
  • SDN can enable multi-tenancy by presenting different virtual networks to different customers while utilizing the same underlying physical infrastructure.

Both microsegmentation and SDN are increasingly being used to implement something called a Zero Trust Model. In this model, users and devices are considered untrustworthy by default, even if they are already inside the corporate network. To become “trusted” and gain access to network resources, the device or user must meet certain conditions, such as undergoing a virus scan or completing Two-Factor Authentication (2FA).

Whether you’re trying to achieve PCI compliance or simply enhance security in your organization, network segmentation is an important part of a broader information security program. The Varonis Data Protection platform can help you identify the parts of your network where important data is being stored so you can build an effective segmentation strategy. Want to learn more? Schedule a 1:1 demo today!

What you should do now

Below are three ways we can help you begin your journey to reducing data risk at your company:

  1. Schedule a demo session with us, where we can show you around, answer your questions, and help you see if Varonis is right for you.
  2. Download our free report and learn the risks associated with SaaS data exposure.
  3. Share this blog post with someone you know who'd enjoy reading it. Share it with them via email, LinkedIn, Reddit, or Facebook.

Try Varonis free.

Get a detailed data risk report based on your company’s data.
Deploys in minutes.

Keep reading

Varonis tackles hundreds of use cases, making it the ultimate platform to stop data breaches and ensure compliance.

how-to-create-and-manage-the-azure-network-watcher-resource
How to Create and Manage the Azure Network Watcher Resource
The Azure Network Watcher comes with great diagnostic and monitoring tools. Learn more about how to create a Network Watcher and manage its components.
what-is-an-smb-port-+-ports-445-and-139-explained
What is an SMB Port + Ports 445 and 139 Explained
An SMB port is a network port commonly used for file sharing. IBM programmer Barry Feigenbaum developed the Server Message Blocks (SMB) protocol in the 1980s for IBM DOS. SMB continues to be the de facto standard network file sharing protocol in use today.
network-flow-monitoring-explained:-netflow-vs-sflow-vs-ipfix
Network Flow Monitoring Explained: NetFlow vs sFlow vs IPFIX
Modern networking equipment is capable of processing billions of packets every second, but most of that work happens behind the scenes. Network Flow Monitoring, also known as packet sampling, aims…
what-is-dcom-(distributed-component-object-model)?
What is DCOM (Distributed Component Object Model)?
DCOM (Distributed Component Object Model) is a programming construct that allows a computer to run programs over the network on a different computer as if the program was running locally. Our guide details everything you need to know and more, check it out!