What Is Microsegmentation? How It Limits Lateral Movement
In late 2013, attackers used credentials stolen from Target’s heating and air conditioning contractor to enter its network, then reached the point-of-sale systems. What is microsegmentation? It is the control built for that problem: dividing a network into small, isolated zones, each with its own access rules, so one breach cannot spread.
What Is Microsegmentation?
Microsegmentation is a security technique that divides a network into small, isolated segments, down to individual workloads or applications, and applies least-privilege access rules to each one. By controlling east-west traffic between segments, it stops attackers who breach one system from moving laterally across the network. CISA describes it as a critical component of zero trust architecture.
Micro Segmentation in Plain English
Think of an office building. Traditional security locks the front door. Microsegmentation also locks every office, and gives each person a key only to the rooms their job needs. Someone who gets through the front door still cannot wander.
A Simple Microsegmentation Example
A web server needs to talk to one database on one port. With microsegmentation, that is the only connection allowed. The web server cannot reach file servers, other databases or staff laptops, and staff laptops cannot reach the database directly. If the web server is compromised, the attacker can reach exactly one database port, not the whole network.
The Target Breach: A Public Case Study in Lateral Movement
The US Senate Committee on Commerce, Science and Transportation published a “kill chain” analysis of the Target breach in March 2014. It is still one of the clearest official accounts of what happens without internal segmentation.
According to the committee’s analysis, attackers first stole network credentials from Fazio Mechanical Services, a heating and refrigeration vendor with access to Target’s systems for billing and project work. From that foothold, they moved through Target’s network until they reached the point-of-sale systems, where they installed malware. The breach exposed about 40 million credit and debit card numbers and personal information on about 70 million customers. The committee noted that Target had missed opportunities to isolate its most sensitive systems from the rest of the network.
The lesson is direct: the vendor credential was the way in, but the lack of internal barriers turned a vendor login into a payment card breach. Keep that path in mind through each section below. Microsegmentation is designed to make the second half of that story impossible: a vendor portal segment that cannot reach payment systems at all.
Why Perimeter Security Is Not Enough: East-West Traffic
North-south traffic flows in and out of the network, through the firewall. East-west traffic flows between systems inside it. Perimeter firewalls inspect the first and often ignore the second. Once an attacker is inside, through a phished login, an exposed service or a vendor account, east-west traffic is where lateral movement happens, as it did at Target.
How Microsegmentation Limits Lateral Movement
Default Deny and Least-Privilege Policies
Microsegmentation starts from “deny everything,” then allows only the specific connections each workload needs. Anything not on the allowlist is blocked and logged. An attacker probing for the next system hits a wall and, ideally, an alert.
Shrinking the Blast Radius of a Ransomware Attack
Ransomware spreads by reaching file shares, backups and servers over the network, often through admin protocols such as SMB and RDP. Microsegmentation limits who can use those protocols and from where, so an infected laptop can encrypt its own files but not the finance server or backup repository. CISA’s 2025 guidance names limiting lateral movement and shrinking the attack surface as core benefits.
How Does Microsegmentation Work?
At a high level, it follows three stages (the companion guide on implementation covers each in detail):
- Discover: map workloads and how they communicate.
- Define: group assets and write rules for allowed flows.
- Enforce and monitor: apply rules, log blocked traffic and adjust as applications change.
Types of Microsegmentation
Host-Based (Agent) Microsegmentation
A software agent on each server or workload enforces rules using the host’s own firewall. It works the same across data centers and clouds and gives detailed visibility into which process makes each connection.
Network-Based Microsegmentation
Switches, routers, firewalls or software-defined networks enforce rules. No agent is needed, which suits devices that cannot run one, but rules usually follow IP addresses and network locations.
Cloud-Native and Container Microsegmentation
Cloud platforms provide security groups and network access controls, and Kubernetes provides network policies that restrict traffic between pods. These are microsegmentation tools you may already have.
Identity-Based Segmentation
Rules follow users, devices or workload identities instead of IP addresses, so a policy such as “only the payroll application may reach the payroll database” holds even as servers move or scale.
Microsegmentation vs Network Segmentation
| Network segmentation | Microsegmentation | |
|---|---|---|
| Unit of control | Large zones, such as VLANs or subnets | Individual workloads or applications |
| Typical tools | VLANs, ACLs, perimeter and internal firewalls | Host agents, cloud security groups, software-defined networking |
| Traffic focus | Mostly north-south and between zones | East-west, including within a zone |
| Rules based on | IP ranges and network location | Workload identity, application and context |
| Effort | Lower | Higher, needs dependency mapping |
Network segmentation is the coarse first layer. Microsegmentation adds fine-grained control inside each zone. Most organizations need both.
Benefits of Microsegmentation
- Limits lateral movement and ransomware spread
- Shrinks the attack surface of each workload
- Gives visibility into internal traffic flows
- Supports zero trust principles in NIST SP 800-207
- Can reduce compliance scope for regulated systems
Microsegmentation Challenges
The hardest part is knowing what talks to what. Undocumented dependencies mean an overly strict rule can break an application. Rules multiply as environments grow, legacy and OT systems may not support agents, and policies need an owner as applications change. Starting in monitor mode, where rules log instead of block, reduces the risk of outages.
Microsegmentation Use Cases
Data Centers and Hybrid Cloud
Consistent rules across on-premises servers and cloud workloads stop an attacker from using one environment as a bridge into the other.
Compliance Scope Reduction (PCI DSS, HIPAA)
The PCI Security Standards Council’s scoping and segmentation guidance (2016) explains that segmentation is not required by PCI DSS but, when properly isolating the cardholder data environment, can reduce the systems in scope. Isolating systems that hold protected health information supports HIPAA Security Rule access controls. Confirm scope decisions with your assessor.
Protecting OT, IoT and Legacy Systems
Devices that cannot be patched or run agents, such as building controls, medical devices or old servers, can be placed in tightly restricted segments. The IEC 62443 standards for industrial systems use the same idea through “zones and conduits.” The Target case shows why vendor-managed building systems belong in their own segment.
What Is Microsegmentation Worth? Could a Vendor Login Reach Your Payment Systems?
What is microsegmentation worth? At Target, it was the difference between a vendor login and a card breach. Here is the challenge: pick one vendor or contractor account and trace every system it can reach today. If the answer includes anything sensitive, you have found your first segment. Cyber Security Solutions Ltd can help you map those paths as part of a free assessment, which you can request through our contact page.
FAQs
No. Zero trust is a security strategy built on never trusting by default and verifying every access request. Microsegmentation is one control that puts that strategy into practice on the network, by limiting which workloads can talk to each other. CISA calls it a critical component of zero trust, alongside identity, device and data controls.
Yes. Cloud platforms include native tools such as security groups and network access control lists, and Kubernetes network policies restrict traffic between pods. Host-based agents also work across clouds. Many organizations use one policy approach for both data center and cloud workloads, so rules stay consistent when applications move or scale.
No. A VLAN is traditional network segmentation that separates large groups of devices into zones. Devices inside the same VLAN can usually still talk freely to each other. Microsegmentation controls traffic between individual workloads, including those in the same VLAN or subnet, using rules based on application or identity, not just network location.
Most small businesses should start with basic segmentation: separate guest Wi-Fi, IoT devices, payment systems and servers into their own zones, and restrict admin protocols such as RDP and SMB. Full workload-level microsegmentation suits businesses with servers holding sensitive data, compliance needs or vendor access to internal systems.
East-west traffic is network traffic that moves between systems inside your network, such as a laptop connecting to a file server or one server calling another. North-south traffic moves in and out through the internet edge. Attackers who get inside use east-west traffic to move laterally, which is what microsegmentation controls.
It does not stop the first infection, but it can sharply limit the spread. By blocking unneeded connections between devices and restricting admin protocols such as SMB and RDP, microsegmentation keeps ransomware from reaching file servers, other workstations and backups. Pair it with patching, MFA, endpoint protection and offline backups.
