Network Segmentation

In 2013, attackers compromised Target's network through an HVAC vendor. Once inside, they moved laterally, hopping from the vendor's system to the point-of-sale terminals, because the network was flat. Everything could reach everything. The result: 40 million stolen credit card numbers.

A flat network is one where every device can communicate with every other device. Convenient for small setups, catastrophic at scale. If an attacker compromises one machine, they can scan and attack the entire network.

Network segmentation breaks the network into isolated zones with controlled access between them. Your web servers can talk to your app servers. Your app servers can talk to your databases. But your web servers cannot talk directly to your databases. If a web server is compromised, the attacker is trapped in that segment, they can't reach the database without going through the app tier, where additional security controls are enforced.

This is defense in depth applied to networking. Every boundary is another barrier an attacker must overcome.

Tier-based segmentation: The most common pattern in cloud environments.

Implementation in cloud:

• Subnets create the segments
• Network ACLs enforce coarse rules at the subnet boundary
• Security Groups enforce fine-grained rules at the instance level
• Route tables control what can flow between segments

Microsegmentation (advanced): Instead of segmenting by tier, segment by individual workload. Each microservice gets its own security group with rules allowing only the specific ports and protocols it needs. Service A can reach Service B on port 8080, but nothing else. This is the foundation of zero trust networking.