NexusSec.The problem we solve
In most networks we assess, any device can reach almost any other. A compromised reception PC can attempt to connect to the backup server. Guest Wi-Fi can reach internal printers. The CCTV recorder shares a network with finance systems.
This is why breaches escalate. The initial compromise is usually unremarkable — a phishing email, an unpatched service. On a flat network, an attacker converts that foothold into domain-wide compromise within hours. Segmentation is what breaks that chain. See what is network segmentation for the concept.
VLANs alone are not segmentation
The zone model we implement
| Zone | Contents | Policy principle |
|---|---|---|
| User | Staff laptops, desktops, VoIP | Access to named server services only, never whole subnets |
| Server | Applications, databases, file services | No general internet browsing; tightly controlled inbound |
| Management | Switch, firewall, hypervisor, iDRAC/iLO interfaces | Reachable only from named admin workstations, ideally with MFA |
| Backup | Backup appliances and repositories | Most restricted zone; not reachable from user networks |
| Guest Wi-Fi | Visitor devices | Internet only, client isolation enabled, no internal routes |
| IoT / OT | Cameras, printers, sensors, building systems | Heavily restricted; usually no internet and no internal access |
| DMZ | Internet-facing services | Isolated from internal; strictly controlled both directions |
How we implement it without breaking things
Segmenting a live network carelessly causes outages. Our method:
- Discovery. We analyse actual traffic flows to learn what genuinely communicates with what — which is never what the documentation says.
- Zone design. Zones and addressing designed around your business, not a generic template.
- Policy drafting. Rules written by service, with justification recorded so future teams understand intent.
- Monitor mode first. Policy deployed in logging-only mode so we can see what would be blocked — catching legitimate flows nobody remembered before they break.
- Phased enforcement. One zone at a time, starting with the lowest-risk, monitoring between each phase.
- Backups and management first for isolation, since these deliver the greatest protection against ransomware.
- Validation. We test that boundaries genuinely hold, including penetration testing to confirm it.
What you gain
- Contained breaches — a compromised laptop cannot reach servers or backups.
- Protected recovery — isolated backups remain available when ransomware strikes.
- Early warning — inter-zone denials are excellent indicators of compromise or misconfiguration.
- Reduced IoT exposure — unpatched cameras and printers can no longer be pivots.
- Cleaner troubleshooting — well-defined zones make network problems easier to isolate.
Micro-segmentation
Where appropriate — typically virtualised environments — we extend to micro-segmentation, applying policy between individual workloads so two servers in the same tier cannot communicate unless explicitly permitted. Most organisations should complete zone-level segmentation first; it delivers the larger share of the benefit.