Its security value comes from enforced boundaries — such as firewalls, access-control lists, gateways, proxies, or physically separate paths — not merely from drawing separate network ranges or assigning virtual LANs (VLANs).
Good segmentation limits unnecessary reachability, reduces attack paths, contains failures, and creates useful monitoring points. Policy should be based on business and process dependencies: which source may reach which destination, using which service, for what purpose, and under whose ownership.
Key points
Primary purposeReduce exposure and limit lateral movement or fault propagation.
Design methodGroup assets by function, criticality, trust requirement, and process dependency; then define and test permitted conduits.
Operational needDocument flows, remove obsolete rules, monitor boundary traffic, and test both allowed and denied paths after changes.
Resilience cautionSegmentation must preserve required safety, management, failover, time, name-resolution, and recovery services.
Important limitationA VLAN alone is not a security boundary, and an over-permissive firewall between zones provides little containment.