Network segmentation
Network segmentation is the division of a network into distinct physical or logical zones with controlled communication between them.
Secure APIs
Network segmentation is the practice of dividing a network into isolated subnets to limit communication between components with different risk profiles.
- How it is used
- Uses isolated subnets as an infrastructure control for limiting API attack paths and containing compromised services.
- How deep it goes
- Explains the definition, SSRF consequence, DMZ pattern, AWS implementation options, and traffic restrictions without detailing subnet design procedures.
- Examples
- Uses a user-avatar SSRF path to an admin service, plus DMZ, AWS VPC, subnet, ACL, security-group, and bastion-server topologies.
- What you can do after
- Operate/configure API infrastructure by separating services, routing through a DMZ, restricting traffic, and checking unintended exposure paths.
Acing the CCNA Exam: Volume 1 Fundamentals and Protocols
Network segmentation is the division of a network into separate logical or physical segments to limit the scope of communication.
- How it is used
- Uses segmentation to improve network security and performance by separating broadcast domains and communication paths.
- How deep it goes
- Explains Layer 2 and Layer 3 boundaries, port behavior, tagging, and basic Cisco configuration, but not detailed design policy.
- Examples
- Uses unsegmented, Layer 3-segmented, and combined Layer 2/Layer 3 network scenarios plus VLAN configuration commands.
- What you can do after
- Apply it via Cisco IOS commands to create VLANs, assign access ports, inspect membership, and configure segmented switching.
Read how Acing the CCNA Exam: Volume 1 Fundamentals and Protocols explains network segmentation →
Data-Driven Cybersecurity
Network segmentation is the division of a network into isolated or separately controlled segments to limit traffic and restrict the spread or reach of attacks.
- How it is used
- Limits unauthorized traffic and lateral movement while supporting containment, access control, and protection of sensitive systems.
- How deep it goes
- Explains purposes, design granularity, enforcement mechanisms, monitoring, compliance, and accessibility trade-offs without detailing product-specific configurations.
- Examples
- Uses guest wireless isolation, public-facing web separation, departmental divisions, cloud segmentation, and cardholder-data protection.
- What you can do after
- Operate/configure network boundaries that restrict communication, contain breaches, and balance security requirements against business accessibility.
Read how Data-Driven Cybersecurity explains network segmentation →
Related concepts
- segmentuses · A segment is a distinct portion or bounded region of a larger structure, system, or sequence, with boundaries or properties determined by its context.
- vlanuses · A VLAN is a logically isolated Layer 2 network segment implemented within shared physical network infrastructure, typically forming a separate broadcast domain.
- access control listuses · An access control list is a collection of rules specifying which subjects or traffic may access a resource or perform particular operations.
- firewalluses · A firewall is a network security system that monitors and filters communications according to rules governing which traffic is permitted or blocked.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.