Why a flat network is the real risk
Most of the networks we audit are flat. One VLAN, one broadcast domain, shop-floor devices sitting beside finance laptops and guest Wi-Fi. It works — until one endpoint is compromised. From that point the attacker can reach everything the endpoint can reach, which is everything.
Segmentation does not stop the initial compromise. It decides how far that compromise travels. In every incident we have supported, the difference between a contained event and a shutdown came down to whether zones existed and whether traffic between them was actually inspected.
Start from function, not from hardware
Zones should map to what systems do, not to which switch they plug into. In a typical manufacturing client we end up with four to six zones.
- OT and production: PLCs, HMIs, SCADA servers. Almost no outbound internet.
- Server and application: ERP, file, database, domain controllers.
- Corporate user: laptops, desktops, printers.
- Guest and BYOD: internet only, fully isolated.
- Management: switch, firewall and controller interfaces, reachable only from a jump host.
Write the policy before you move a cable
The mistake we see most often is building VLANs first and writing rules later, which ends with permit-any between zones and a false sense of security. Document what each zone legitimately needs from every other zone, get the application owners to confirm it, then implement.
Run the policy in monitor mode for two to four weeks. Real traffic always contains a legacy integration nobody remembered. Enforce only once the logs are quiet.
Keep it honest over time
Segmentation decays. New projects request exceptions, and exceptions become permanent. We review the inter-zone rule base quarterly with every client, remove anything unused for 90 days, and document the business owner of every remaining exception.
If you would like a segmentation review of your own estate, our engineers can run a discovery and produce a zoning plan without touching production.