# What is Network Segmentation?

> Network segmentation divides an environment into zones and controls the communications allowed between them.

- Canonical URL: https://yellowcube.eu/glossary/network-segmentation/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Its security value comes from enforced boundaries — such as firewalls, access-control lists, gateways, proxies, or physically separate paths — not merely from drawing separate network ranges or assigning virtual LANs (VLANs).

Good segmentation limits unnecessary reachability, reduces attack paths, contains failures, and creates useful monitoring points. Policy should be based on business and process dependencies: which source may reach which destination, using which service, for what purpose, and under whose ownership.

### Key points

- **Primary purpose:** Reduce exposure and limit lateral movement or fault propagation.
- **Design method:** Group assets by function, criticality, trust requirement, and process dependency; then define and test permitted conduits.
- **Operational need:** Document flows, remove obsolete rules, monitor boundary traffic, and test both allowed and denied paths after changes.
- **Resilience caution:** Segmentation must preserve required safety, management, failover, time, name-resolution, and recovery services.
- **Important limitation:** A VLAN alone is not a security boundary, and an over-permissive firewall between zones provides little containment.

### Related terms

[Firewall](<https://yellowcube.eu/glossary/firewall/>) · [Zero trust architecture (ZTA)](<https://yellowcube.eu/glossary/zero-trust-architecture/>) · [Microsegmentation](<https://yellowcube.eu/glossary/microsegmentation/>) · [Operational technology (OT) security](<https://yellowcube.eu/glossary/operational-technology-security/>) · [Data diode / unidirectional gateway](<https://yellowcube.eu/glossary/data-diode-unidirectional-gateway/>) · [Air gap](<https://yellowcube.eu/glossary/air-gap/>)

### Sources

[NIST SP 800-125B: Secure Virtual Network Configuration](https://csrc.nist.gov/pubs/sp/800/125/b/final) · [NIST SP 800-82r3: Guide to Operational Technology Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.