Most networks are not designed. They accumulate. A switch is added for a new department, a cable run is pulled in a hurry for a deadline, a firewall rule is written to make something work on a Thursday afternoon and never reviewed. Each decision is reasonable on its own. The result, after a few years, is a flat network where everything can reach everything.
That works. It works right up until the moment something on it is compromised, and then it stops working everywhere at once.
Why flat is comfortable and dangerous
A flat network is easy to run. Nothing is blocked, so nothing mysteriously breaks. New devices work immediately. Troubleshooting is simpler because there are fewer places for traffic to be stopped.
The cost is that you have no containment. A laptop that picks up malware from an email attachment sits on the same broadcast domain as the finance server, the CCTV recorder, the building management system and the domain controller. There is nothing between them but the operating systems, and operating systems are exactly what the attacker is targeting.
What segregation actually means in practice
Segregation is not one thing. It is a set of boundaries chosen to match how the business actually works. The zones we most often build in Egyptian office and industrial environments are:
- DMZ — anything that must be reachable from the internet, and nothing else.
- Corporate — user devices, printers, the everyday estate.
- Server — the applications and databases the business runs on.
- Operational technology — production, building systems, cameras. Frequently running software that cannot be patched and must therefore be isolated instead.
- Guest and BYOD — internet only, no route to anything internal.
- Management — switch, firewall and hypervisor interfaces, reachable only from named administrative machines.
The last one is the one most often missed and the one that hurts most when it is missing. If your switch management interfaces are reachable from any user VLAN, an attacker who lands on a receptionist laptop can reconfigure your network.
Rules people can actually maintain
A segregated network is only as good as its rule set, and a rule set nobody understands decays quickly. Three habits keep it usable:
- Every rule has a comment saying what it is for and who asked for it. A rule with no stated purpose can never be safely removed, so it never is.
- Deny by default between zones. Open what is needed, not what is convenient.
- Review on a schedule. Twice a year, walk the rule set and remove what no longer applies. Projects end; their firewall exceptions rarely do.
Detection belongs at the boundaries
Once you have zones, you have natural places to inspect traffic. Intrusion detection at a boundary is far more informative than intrusion detection everywhere, because traffic crossing a boundary is inherently more interesting than traffic within one. Lateral movement — the phase where an attacker who owns one machine starts reaching for others — has to cross a boundary to matter, and that is where you can see it.
Doing it without a weekend outage
The objection we hear is that segmenting a live network means downtime. It does not have to. The sequence that works is: survey what actually talks to what, build the zones alongside the existing flat network, move one low-risk group first, watch for a week, then migrate the rest in planned batches. The firewall runs in monitor mode before it runs in enforce mode, so you find out what you are about to break before you break it.
Segregation is the difference between an incident and a shutdown. It does not prevent the first machine being compromised. It decides whether that is the end of the story.
We survey, design and migrate segregation on live networks without weekend outages. Network Security →
