Network segmentation divides a network into isolated or separately controlled areas, limiting traffic between them and reducing how far an attacker or breach can spread. It also supports performance and access control when segments are designed around organizational needs. section 7.6.1 section 9.7
Common segmentation decisions include:
- Separate public-facing web servers from internal networks containing sensitive data. section 7.6.1
- Divide departments, user groups, or cloud environments into more granular segments when access needs differ. section 7.6.1
- Enforce permitted communication with firewalls, virtual local area networks, and access control lists. section 7.6.1
- Monitor traffic patterns to identify unusual activity and verify that controls work as intended. section 7.6.1
Guest wireless access
A guest connected to wireless should not be visible in the office production environment. Separating those environments limits unauthorized access and prevents a compromise in the guest segment from reaching production systems. section 7.6.1
Segmentation is also a preventative containment measure: if malware reaches one segment, isolation can restrict its spread and make the incident easier to monitor and manage. Effective designs balance protection with accessibility, because excessive segmentation can create complexity, hinder legitimate work, and reduce user satisfaction. PCI DSS supports segmentation for protecting cardholder data. section 9.7 section 7.6.1
