Last updated · reviewed for accuracy
Zero Trust & segmentation
The old security model was a castle: hard wall, soft inside. Attackers stopped storming the wall and started walking through the gate as someone else, and once inside a flat network, everything was reachable. This lesson is about what replaced the castle.
The problem with trusting the inside
Perimeter-only security assumes everything inside the firewall is friendly. One phished laptop breaks the assumption: the attacker is now inside, and a flat network lets them reach servers, printers and backups alike. That is lateral movement.
Real breach reports read the same way every time: initial access is mundane (a credential, an attachment), and the damage comes from what happened after, weeks of quiet movement between systems that trusted each other simply for sharing an address range. The wall held; the rooms had no doors.
Segmentation: doors between the rooms
Segmentation divides a network into zones with filtering between them: user VLANs, server zones, guest networks, management networks. A compromise in one zone must fight through a policy checkpoint to reach the next.
You already own every tool this requires: VLANs draw the zones, routing connects them on purpose, and firewall policy or ACLs stand at each junction. A sensible small-office cut: users, servers, guests, and a management zone for switch/router/firewall interfaces that only admins can reach.
- Guests never reach internal zones at all: internet only.
- Users reach the specific server ports they need, not the server zone wholesale.
- Nothing initiates connections into the management zone except admin hosts.
Zero Trust: location is not identity
Zero Trust drops the assumption that network location implies trust. Every request is authenticated, authorized and encrypted, whether it comes from the office LAN or a hotel: the network you are on stops being a credential.
The practical shifts: strong identity with MFA everywhere; per-application access (this app, not the whole subnet) granted per session; device health as part of the decision; and encryption internally, not just at the edge. Segmentation still matters: Zero Trust shrinks the segment until, at the ideal, each application is its own perimeter.
Getting there without a rip-and-replace
Zero Trust is a direction, not a product. Real networks move stepwise: segment first, add MFA, then move high-value applications behind identity-aware access, one at a time.
- Step 1: separate guests, users, servers and management (you can do this today with VLANs).
- Step 2: MFA on everything that matters; kill shared passwords.
- Step 3: put the crown-jewel apps behind identity-aware proxies; retire their VPN-wide reachability.
- Step 4: log and review the east-west traffic you can now actually see (next lesson).
The tools are ones you already know
Segmentation is applied VLANs + filtering. If you can configure the Cisco-track pair (VLANs in IOS and ACLs in IOS) you can build a segmented network end to end.
Frequently asked questions
What is lateral movement?
An attacker’s sideways spread after the first compromise, from one machine to whatever it can reach. Flat networks make it trivial; segmentation makes every hop a fight.
Is Zero Trust a product I can buy?
No. It is an architecture: verify explicitly, least privilege, assume breach. Vendors sell useful components, but no single purchase makes a network Zero Trust.
Does Zero Trust replace VLANs and firewalls?
It builds on them: zones and checkpoints stay, but decisions weigh identity, device health and context instead of source subnet alone, and the zones shrink toward per-application.