Definition
Network segmentation is a security technique that divides a computer network into smaller, isolated subnetworks or segments. This isolation limits the scope of potential security breaches and controls the flow of traffic between different network zones. It works by implementing firewalls, routers, or virtual local area networks (VLANs) to enforce access controls and traffic policies between segments. Implementing network segmentation is crucial for minimizing the attack surface, preventing the lateral movement of malware, and enhancing overall network performance and reliability. For instance, a company might segment its guest Wi-Fi network from its internal corporate network to protect sensitive data. Unlike network subnetting, which is primarily for IP address management, segmentation focuses on security boundaries and access control. This concept is a core topic in cybersecurity certifications like CompTIA Security+, CySA+, and CISSP.