What is network segmentation and why is it required?

Answer

Network segmentation divides networks into isolated sub-networks to improve security by limiting adversary movement and protecting sensitive government data.

Understanding Network Segmentation

Think of network segmentation like the watertight compartments in a ship. If one compartment is breached and floods, the watertight doors prevent water from spreading to other compartments, limiting damage and keeping the ship afloat.

Similarly, network segmentation creates boundaries within your network so that if adversaries compromise one segment, they face additional barriers preventing them from easily reaching other segments. Without segmentation, networks resemble open-plan spaces where anyone who gets in can access everything—segmentation creates rooms with locked doors that require additional credentials and controls to pass through.

Why Segmentation Matters for Defence Contractors

Defence contractors typically have diverse network zones with different security requirements. Public-facing systems like corporate websites, marketing email servers, and customer portals need internet accessibility but contain less sensitive information.

General business systems including email, file servers, HR systems, and financial applications support day-to-day operations. Development and testing environments contain pre-release software and test data. Operational technology (OT) or industrial control systems may operate manufacturing or physical security systems.

Most critically, systems handling specified information process, store, or transmit sensitive government data requiring heightened protection. Mixing these diverse environments on a single flat network creates unnecessary risk—a compromised web server shouldn't provide attackers direct access to systems containing defence contract information, yet that's exactly what happens without segmentation.

ITSP.10.171 Segmentation Requirements

The CPCSC standard includes multiple requirements related to segmentation, particularly in the System and Communications Protection family. These requirements stem from NIST SP 800-171 control families addressing the architecture principle of defense-in-depth, where multiple layers of security controls protect against threats.

Organizations must meet the following requirements:

• Implement boundary protection devices (firewalls, routers, gateways) that monitor and control communications at external and key internal system boundaries
• Enforce information flow policies controlling how specified information can transit within the system and between systems
• Separate public-facing systems from internal systems, particularly those handling specified information
• Implement subnetworks for system components with different security characteristics

Common Segmentation Approaches

Several architectural approaches implement network segmentation effectively:

• Demilitarized zones (DMZ): Place public-facing servers in a separate network segment isolated from both the internet and internal networks, with firewalls controlling traffic in both directions
• Virtual LANs (VLANs): Create logical network segments on physical switch infrastructure, separating traffic types (guest wireless, employee workstations, servers, IoT devices) even when using shared physical infrastructure
• Security zones: Group systems by security requirements and data sensitivity, establishing separate zones for public access, general business, specified information systems, administrative management, and secure remote access
• Microsegmentation: Takes segmentation to its logical extreme, isolating individual workloads or applications with specific security policies controlling traffic between each, often implemented using software-defined networking or cloud security groups

Each approach has tradeoffs between security granularity, implementation complexity, and operational overhead.

Implementing Network Segmentation

Practical segmentation implementation involves several technical components:

• Firewall rules: Define what traffic can pass between segments, typically following a default-deny approach where all traffic is blocked unless explicitly permitted
• Routers and switches: Enforce VLANs and route traffic between segments according to security policies
• Access control lists (ACLs): On network devices filter traffic based on source, destination, protocol, and port
• Virtual Private Networks (VPNs): Or encrypted tunnels protect specified information transiting between segments or across untrusted networks
• Network access control (NAC) solutions: Verify devices meet security requirements before allowing network access
• Intrusion detection and prevention systems (IDS/IPS): Monitor traffic between segments for suspicious patterns and can automatically block threats
• Next-generation firewalls: Provide application-level control beyond simple IP and port filtering

The specific technologies depend on your infrastructure, scale, and budget, but the principles remain consistent.

Segmentation for Remote Access

Remote workers accessing systems that handle specified information create particular segmentation challenges. VPN solutions should terminate remote connections in a dedicated security zone, not directly on the internal network, allowing firewall controls between the VPN segment and specified information systems.

Multi-factor authentication should protect VPN access to verify user identity before granting network access. Split-tunneling (where some traffic routes through VPN and other traffic goes direct to internet) is often discouraged for users accessing specified information, as it creates risk of cross-contamination.

Cloud-based secure access service edge (SASE) or zero-trust network access (ZTNA) solutions provide more granular control, authenticating and authorizing each access request rather than granting broad network access once VPN connects. The goal is ensuring remote access receives the same segmentation benefits and controls as on-premise access.

Cloud Environment Segmentation

As contractors increasingly use cloud services, segmentation principles extend to cloud environments through security groups, network security groups, or virtual private clouds (VPCs) that isolate cloud resources logically. Separate cloud accounts or subscriptions for different environments (production, development, specified information, general business) create strong isolation.

Network segmentation within cloud environments separates public-facing services, application tiers, and data storage. Private connectivity between on-premise environments and cloud (AWS Direct Connect, Azure ExpressRoute, Google Cloud Interconnect) rather than traversing the public internet protects specified information in transit.

Identity-based segmentation supplements network segmentation, as cloud environments often emphasize identity and access controls over traditional network boundaries. Organizations operating hybrid environments spanning on-premise and cloud must extend their segmentation architecture cohesively across both.

Segmentation for BYOD and Mobile Devices

Employee-owned devices and mobile devices create segmentation challenges since they're less controlled than corporate assets. Several approaches address these challenges:

• Containerization: Separates corporate data and applications from personal data on the same device, applying security controls to the corporate container without impacting personal use
• Mobile Device Management (MDM): Or Enterprise Mobility Management (EMM) solutions enforce segmentation by controlling which devices can access corporate resources and what those devices can do
• Per-app VPN: Routes corporate application traffic through VPN tunnels while allowing personal application traffic to bypass it
• Application-level access control: Grants mobile access to specific applications without providing broad network access

For CPCSC purposes, mobile devices accessing specified information should be corporate-controlled rather than personal devices, or should use robust containerization and access controls if BYOD is permitted.

Monitoring and Maintaining Segmentation

Segmentation is only effective if it's properly maintained over time. Several ongoing activities prevent segmentation erosion:

• Network monitoring tools: Continuously verify that traffic flows match intended segmentation policies and alert on unexpected traffic patterns
• Configuration audits: Regularly review firewall rules, ACLs, and security group settings to ensure they remain appropriate and haven't drifted from documented standards
• Penetration testing: Validates segmentation effectiveness by attempting to move laterally between segments and identifying potential bypass routes
• Change management: Ensures network changes are reviewed for segmentation impacts before implementation
• Documentation: Maintains current network topology diagrams, segmentation rationale, and security zone definitions

These ongoing activities prevent segmentation erosion that commonly occurs as operational pressures drive exceptions and shortcuts that gradually undermine the security architecture.

Common Segmentation Mistakes

Organizations often fall into segmentation anti-patterns:

• Overly permissive firewall rules: Broad "any-any" rules that allow all traffic between segments negate segmentation benefits
• Legacy systems exempted: Systems exempted from segmentation requirements because they're "too hard to isolate" create persistent vulnerabilities
• Insufficient granularity: Only one or two large segments rather than appropriate security zones limits segmentation effectiveness
• Lack of monitoring: Segmentation exists in theory but violations aren't detected in practice
• Temporary exceptions that become permanent: Gradually erode security architecture

Each of these mistakes undermines the defense-in-depth benefits that segmentation is meant to provide.

Business Process Implications

Implementing network segmentation can impact business processes that previously relied on flat network connectivity. Users accustomed to accessing any system may encounter access restrictions requiring requests and approvals. Applications that communicated freely across the network may require firewall rule changes to maintain functionality.

Management protocols and monitoring tools may need architectural changes to work across segment boundaries. These disruptions are temporary and manageable with good planning, communication, and change management, but they're real and should be anticipated rather than surprising stakeholders.

Cost and Resource Considerations

Network segmentation requires investment in several areas:

• Equipment: Firewalls, switches supporting VLANs, network monitoring tools
• Design and implementation: Network architecture design, configuration, testing, and documentation
• Ongoing operations: Monitoring, rule management, incident investigation

For small organizations, basic segmentation using existing firewall and switch capabilities may be achievable with minimal incremental cost. Larger organizations with complex environments may invest substantially in sophisticated segmentation architectures.

The investment is justified by the risk reduction segmentation provides—numerous high-profile breaches were amplified by flat networks that allowed initial compromises to spread unchecked throughout the environment.

Segmentation as Defense-in-Depth

Network segmentation is a single layer in a comprehensive security strategy. It works in concert with access controls limiting who can authenticate to systems, endpoint protection detecting and preventing malware, data encryption protecting information even if accessed, security monitoring detecting suspicious activity, and incident response containing and remediating breaches.

No single control is sufficient—defense-in-depth means adversaries must overcome multiple independent security layers to achieve their objectives. Segmentation ensures that even if perimeter defenses fail and adversaries gain initial access, they face additional obstacles before reaching sensitive specified information systems.

Learn More

The following resources provide additional guidance on network segmentation:

• Protecting Specified Information (ITSP.10.171)
• Baseline Security Requirements for Network Security Zones (ITSP.80.022)