Twenty Years of Network Security Lessons: Why Segmentation is Mandatory

And yet here I am, hyper-caffeinated brain bathing in its third mugful of coffee this morning, sitting at my desk and thinking back on twenty years of network security—back when I was a naïve network admin in ’93, and managing voice and data mux over PSTN seemed like something reserved for unicorns and wizards. Update, Nov. 1: What do you know, I wake up today and here’s a report about a serious threat that made its way onto one air-gapped network (Samsung is high on the list of potential culprits in this story). And yes, I still remember Slammer like it was yesterday — a stinging slap in the face that should have made it clear to everyone that network segregation is not just a good idea, it’s mandatory.

No VLAN Segmentation

Once upon a time, networks were simpler — flat and sprawling. No VLAN’s no fancy zones, just one great big (or very bad) broadcast domain. But that simplicity? It’s a security nightmare.

It’s like this: without VLANs, your network’s a wide open road with no speed limits. After a hacker or malware gets into one, it’s fair game. It’s not local crashes, everything spreads — sickness throughout your enterprise.

I’ve watched this in action up close, assisting banks in their upgrades to zero-trust architectures over the past couple of years (three banks, three completely different backgrounds, with the same, age-old issue). No VLANs, so attackers had lateral movement for days. They could shift from one system to another with little effort.

You may say, ‘Okay my firewall’s at the perimeter, I’m good.’ But that’s just half the equation—after the perimeter is breached, a flat network is a smorgasbord.

Flat Network Risks

Flat networks? Big no-no. Consider them an old town without door locks, just wide-open saloons and shops. If someone breaks in, they’re in everywhere.

The risks:

• No Sideways Movement restriction. Malware or a bad actor hopscotches through machines with no barriers. It is like a wildfire with no firebreaks.
• Data Leakage. Sensitive information goes everywhere — no containment in sight.
• Slow Incident Response. When it’s all getting mashed together, hunting down and isolating a breach is like trying to find a needle in a haystack.

You gotta compartmentalize. Segment not only to secure, but to manage.

IoT and Guest Network Isolation

But right now, whether it’s your fancy new smart phone, that conference room system or maybe even the new coffee maker — all share one feature in common — they are all risky. IoT devices are considered grindtopia because most ship out of the box with a steaming pile of crap security. Guest networks? Often an afterthought.

Without segmenting those devices off your main business network, you might as well be sending hackers engraved invitations to a party where the WiFi password is actually taped to the side of your refrigerator.

Quick anecdote: At DefCon’s hardware hacking village, I talked with some pros who demonstrated just how simple it was to use a smart light bulb in an attempt to breach an entire corporate network. Frightening stuff.

Just as you would keep your spicy Indian curry separate from the naan bread. Quarantine and closely monitor the IoT and guest VLANs, implementing stricter firewall rules.

Least Privilege Access

Here’s a security fundamental that many forget when thinking about firewall segmentation: least privilege access. That’s the concept that you provide users or devices only with the permissions that they absolutely need and no more.

In practice, this means:

• Segment your network and restrict traffic between segments with firewalling rules.
• Nobody in financial should have open access to R&D systems just because they’re on the same network.
• Servers speak only to servers they absolutely need to.

This strategy reduces blast radius when something goes sideways.

Yes, some say it can make things complicated to manage. But by now complexity wins over exposure any day. When misconfigured firewall rules used to be more troubling then the attacks. I remember those times. But hey, we learn.

Best Practice: Micro-Segmentation

Now on to the big guns — micro-segmentation. It’s as though you sliced up your network into a complex chessboard, and then controlled the movement of all of these squares with an incredibly powerful set of firewall rules.

Why micro-segmentation? Because:

• It dramatically reduces attack surface by de-perimeterizing the traffic flows.
• Enables policy to be enforced at the granular level of workloads or applications.
• Does zero trust well, that’s where the world of cybersecurity is heading (and where I’ve been helping banks steer their ships lately).

Some best practices while doing micro-segmentation are:

• Begin with a deep network map.
• Rely on tools that visualize traffic flows — you can’t protect what you can’t see.
• Whitelist, Don’t blacklist. Block all by default.
• Regularly update and review rules — threats change, and so should your segmentation.

Here’s a radical idea: Don’t mindlessly invest in AI-powered firewall segmentation offerings that you can’t understand the logic — or lack of logic — behind. Some AI is definitely snake oil — I won’t believe it until I see it.

Quick Take

• Full access: if no VLANs used, any compromise leads to all in (in other words, no network separation). Flat networks increase the risk of infections and data spillage.
• Isolate IoT and guest networks to limit exposure to vulnerabilities.
• Least privilege: For access to resources, have the principle of least privilege to minimize effect of broken accounts or devices.
• Adopt micro-segmentation to enable fine-grained control and zero-trust alignment.

Final Thoughts from a Veteran Network Security Consultant

One last bit and I’ll be done, I’ve been playing the game since a firewall used to be a big box at your network entry point and segmentation was something you did physically with cables. The networks and threats are vastly different now. Now, firewall security must be layered, nuanced and nearly surgical.

At P J Networks Pvt Ltd, we have assisted clients to not only stop the bleeding but also to rebuild their architectures, valuing segmentation as a first principle of security. It’s maddening to see how many orgs still treat their networks like the Wild Wild West.

Segmenting firewalls is not mere technical hygiene; it is the foundation of digital defense. You wouldn’t drive a car with no brakes, you shouldn’t run a network without sufficient separation.

Anyway… rant done for this coffee break. But I hope you’re taking this seriously — because the next worm, ransomware, or hacker isn’t going to wait around for you to get your segmentation right.

Stay safe out there,

Sanjay Seth
Cybersecurity Consultant, P J Networks Pvt Ltd