Network Segmentation.

Network segmentation partitions a flat enterprise network into smaller security zones — user, server, OT, payment (PCI-scope), and management VLANs — each with its own access policy enforced by a firewall, router ACL, or SDN/micro-segmentation controller. By limiting east-west traffic and forcing it through inspection points, segmentation contains lateral movement, shrinks the scope of compliance audits, and operationalises least privilege. Access between zones is granted explicitly rather than by default.

The canonical cautionary tale is the 2013 Target breach: attackers used credentials stolen from HVAC contractor Fazio Mechanical Services to reach an internet-facing vendor portal, then pivoted across a flat network to the point-of-sale environment and exfiltrated roughly 40 million payment-card records. No segmentation isolated the vendor portal from cardholder systems — the control that would have stopped the pivot. PCI DSS Requirement 1 and its segmentation guidance now make isolation the standard way to keep systems out of audit scope.

In industrial settings the Purdue Enterprise Reference Architecture and IEC 62443 zones-and-conduits model define segmentation between enterprise IT and OT. During the 2021 Colonial Pipeline ransomware incident the operator shut down OT as a precaution, unable to be certain the IT compromise had not crossed over. Defences: default-deny inter-zone rules, jump hosts with MFA, and per-zone continuous verification under zero trust (NIST SP 800-207).

flowchart LR
  I[Internet] --> DMZ[DMZ / vendor portal]
  DMZ -->|default-deny FW| U[User VLAN]
  DMZ -->|default-deny FW| S[Server VLAN]
  S -->|jump host + MFA| P[PCI cardholder zone]
  S -->|one-way conduit| OT[OT / SCADA zone]
  X[Compromised vendor account] -.blocked by segmentation.-> P