# What is Microsegmentation?

> Microsegmentation is a security design approach that places granular policy boundaries around small groups of, or individual, workloads, services, endpoints, or application components.

- Canonical URL: https://yellowcube.eu/glossary/microsegmentation/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It limits which identities and resources may communicate, especially across east-west paths inside a data center or cloud. Enforcement may occur in hosts, hypervisors, cloud controls, distributed firewalls, service meshes, or other policy points.

Policies can use addresses and ports, workload identity, labels, device attributes, and application context. Trustworthy inventory and dependency mapping must precede enforcement, or legitimate flows can break. Policies should be tested and introduced progressively.

### Key points

- **Policy model:** Express allowed communication by business purpose and least privilege, including management, monitoring, backup, update, and recovery dependencies — not only primary flows.
- **Enforcement design:** Choose policy points that resist bypass and define behavior when agents, controllers, identity services, or labels are unavailable. Reconcile overlapping host, network, cloud, and service-mesh rules.
- **Operations and OT:** Start with visibility, measure denied flows, stage changes, and maintain rollback. In OT environments, use passive discovery and engineering approval because agents, scans, or blocking can disrupt physical processes.
- **Important limitation:** Microsegmentation is not automatically zero trust and does not correct inaccurate inventory, compromised administration, or application vulnerabilities. Excessive granularity can become unmanageable, while permissive exceptions recreate a flat network. Coverage gaps and shared control planes can still connect segments.

### Related terms

[Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>) · [Zero trust architecture (ZTA)](<https://yellowcube.eu/glossary/zero-trust-architecture/>) · [Distributed firewall](<https://yellowcube.eu/glossary/distributed-firewall/>) · [Cloud network security](<https://yellowcube.eu/glossary/cloud-network-security/>) · [Network access control list (ACL)](<https://yellowcube.eu/glossary/network-access-control-list/>)

### Sources

[CISA: Zero Trust Microsegmentation Guidance, Part One](https://www.cisa.gov/sites/default/files/2025-07/ZT-Microsegmentation-Guidance-Part-One_508c.pdf) · [NIST SP 800-207A: A Zero Trust Architecture Model for Access Control in Cloud-Native Applications](https://csrc.nist.gov/pubs/sp/800/207/a/final) · [NIST SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.