5.3 Segmentation, Microsegmentation, SDN, VPC, and Zero Trust

From zones to verified access

Traditional segmentation divides the environment into zones such as internet edge, DMZ, user LAN, server LAN, production, development, management, and restricted data. This still matters because a well-placed boundary can block many unnecessary paths. However, zone names do not automatically create security. The policy between zones, the identity of the source, the sensitivity of the target, and the monitoring around the flow determine whether the boundary reduces risk.

A DMZ is useful when internet-facing systems must interact with internal services without exposing the internal network directly. A payment application might place public web servers in a DMZ, application services in a protected tier, databases in a restricted tier, and administration in a separate management network. The business value is containment: compromise of the public tier should not immediately grant database access or domain administration.

Microsegmentation applies more precise policy at workload, host, container, process, or identity level. Instead of allowing every system in an application subnet to reach every database port, policy can allow only a specific application service identity to reach a specific database listener. This reduces lateral movement and makes unauthorized flows easier to detect. The tradeoff is complexity: poor policy design can break applications or produce exception sprawl.

SDN, VPC, and zero trust operations

Software-defined networking separates control and data plane functions so policy can be managed through software. In cloud environments, VPCs and VNets provide private address space, route tables, security groups, network ACLs, gateways, private endpoints, and flow logs. These controls are powerful because they can be versioned, reviewed, and deployed as code. They are also risky when teams bypass review or copy permissive templates into production.

Zero trust is not a single product or a synonym for VPN. It is a strategy that removes implicit trust based on location. A user on the office LAN should not automatically have broad application access. A workload in the production VPC should not automatically reach every database. Access decisions should consider identity, device health, workload identity, requested resource, sensitivity, behavior, and current risk signals. Authorization should be least privilege and continuously evaluated.

A practical zero trust network roadmap often starts with visibility. You cannot create durable microsegmentation policy if you do not know which services talk to which dependencies. Flow logs, endpoint telemetry, identity logs, CMDB data, and application owner interviews are used to build an allowlist. The team then enforces policy in stages, beginning with high-value assets and using monitor-only mode when available.

Segmentation design workflow:

1. Identify critical business services and data stores, including owners and recovery requirements.
2. Map normal traffic flows, privileged access paths, third-party access, and emergency operations paths.
3. Define trust boundaries based on data sensitivity, exposure, operational role, and threat model.
4. Choose controls such as firewall policy, security groups, host firewall, service mesh, private endpoints, or ZTNA.
5. Test enforcement in phases, monitor blocked flows, and remove temporary exceptions.
6. Review policy after application changes, mergers, incidents, and cloud account creation.

The leadership issue is sustainable risk reduction. A highly segmented network that nobody understands can fail during an incident. A permissive network that is easy to run can fail during an attack. The CISSP answer is to align segmentation depth with business risk, maintain clear ownership, automate review where possible, and prove through testing that normal and emergency workflows still function.

Segmentation decision checkpoint

Use segmentation depth where it changes risk, not where it merely adds complexity. High-value data stores, privileged administration paths, identity infrastructure, backup systems, and internet-facing workloads usually justify stronger boundaries. Low-risk systems may need simpler controls if strict segmentation would consume scarce operations capacity without meaningful risk reduction. The important point is traceability: every allowed path should have a business purpose, an owner, and enough logging to support incident response.