Segmentation does not change whether someone gets in \u2013 it changes how far they get.<\/p>\n
Zones are cut by protection need, not by the org chart. Between them sits a control point that passes only permitted connections and logs them. The craft is in the cut: too coarse achieves nothing, too fine becomes unworkable.<\/p>\n","protected":false},"featured_media":0,"template":"","glossary_intl_set":[],"glossary_intl_cluster":[392],"glossary_intl_theme":[],"class_list":["post-29165","glossary_intl","type-glossary_intl","status-publish","hentry","glossary_intl_cluster-cybersecurity"],"acf":{"card_description":"Dividing a network into isolated zones to limit damage.","nav_theme":"","nav_subtheme":"","dataset_version":"","term_inline":"","term_plural":false,"heading_overrides":null,"synonyms":null,"lead_definition":"Network segmentation divides a network into separated zones between which only explicitly permitted traffic flows. An infection then stays confined to one zone instead of spreading across the whole network.","at_a_glance":[{"bullet":"Segmentation limits the damage<\/b>, not the access."},{"bullet":"Cut zones by protection need, not by department."},{"bullet":"Without logging at the crossings, half the benefit is missing."}],"intro_answer":"","steps_answer":"","steps":null,"examples":[{"example":"An infection in the office zone never reaches the production plant, because only two protocols are permitted between them."},{"example":"Administrative access runs exclusively through a zone of its own with its own sign-in."}],"misconception":[{"myth":"\u201cWe have a VLAN, so the network is segmented.\u201d","reality":"A VLAN separates broadcast domains. Without enforced rules between zones it is not a security boundary."}],"faq":[{"q":"How finely should you segment?","a":"Finely enough that an infection stays contained, coarsely enough that operations can live with it. NIST SP 800-125B<\/a> sets out an approach."},{"q":"Does segmentation replace zero trust?","a":"No, it is a building block of it. NIST SP 800-207<\/a> places both in context."}],"compare_answer":"","compare":null,"variants":null,"signals_answer":"","signals":null,"protect_answer":"","prevent":null,"incident":null,"related_terms":null,"pillar_link":null,"sources":[{"publisher":"","name":"NIST SP 800-125B","url":"https:\/\/csrc.nist.gov\/pubs\/sp\/800\/125\/b\/final","doc_type":"","group":"used"},{"publisher":"","name":"BSI IT-Grundschutz","url":"https:\/\/www.bsi.bund.de\/DE\/Themen\/Unternehmen-und-Organisationen\/Standards-und-Zertifizierung\/IT-Grundschutz\/it-grundschutz_node.html","doc_type":"","group":"used"}],"reviewer":{"name":"Jakub Novak","qualification":"IT security","date":"2026-06-01"},"disclaimer":""},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t