Network segmentation

Network segmentation refers to the logical or physical division of a corporate network into several separated subnetworks (segments, zones or VLANs), between which traffic is deliberately controlled by firewalls, access control lists or routing rules. The goal is to restrict communication to what is functionally necessary and thereby reduce the attack surface. Typically, external, demilitarised (DMZ) and internal zones are separated, along with particularly sensitive areas such as production, administration or backup networks.

The key security benefit lies in containment: if an attacker manages to compromise a system, consistent segmentation prevents unhindered lateral movement across the network. Malware such as ransomware can thus be confined to a single segment instead of spreading across the entire organisation. In modern architectures the principle is refined down to microsegmentation, where individual workloads or applications are isolated from one another, and it forms a technical foundation of the zero-trust approach.

From a compliance perspective, network segmentation is a central technical measure within risk treatment. The NIS2 Directive and its national transposition oblige essential and important entities to implement appropriate technical measures for network and information security; the BSI IT-Grundschutz addresses segmentation in its network architecture modules (NET layer), and ISO/IEC 27001 requires the separation of services and networks in Annex A. The specific design must be derived from the protection needs assessment and risk assessment and documented in the security policy.