Also known as: network segmentation · east-west segmentation
Microsegmentation is the practice of dividing a network into small isolated zones with explicit policies governing traffic between them, so that a compromised system cannot freely communicate with unrelated systems.
Traditional segmentation operated at the scale of subnets and VLANs. Microsegmentation pushes the boundary down to individual workloads or services, typically enforced by host-based firewalls, service meshes, or cloud security groups rather than physical network topology.
It directly targets lateral movement. In a flat network, one compromised host can reach thousands of others; under microsegmentation it can reach only the specific services its policy permits, which both slows attackers and makes their probing highly visible.
Zero Trust
Zero trust is a security architecture that removes implicit trust based on network location, requiring every request to be authenticated, authorised, and continuously validated regardless of whether it originates inside or outside the corporate network.
Lateral Movement
Lateral movement is the process by which an attacker who has compromised one system moves through a network to reach additional systems, typically hunting for higher-value data or credentials.
Principle of Least Privilege
The principle of least privilege holds that every user, process, and system should be granted only the minimum permissions necessary to perform its function, and no more.
Defense in Depth
Defense in depth is a security strategy that layers multiple independent controls so that the failure or bypass of any single control does not result in compromise.