Micro-Segmentation and Software-Defined Perimeters

In a flat network, once an attacker gains access to one endpoint, they can communicate freely with almost every other system. This enables rapid lateral movement — the technique attackers use to pivot from a compromised workstation to sensitive servers, domain controllers, and data stores. Micro-segmentation directly addresses this by dividing the network into small, isolated zones.

Micro-segmentation divides the network into fine-grained segments where workloads communicate only with explicitly authorized peers. Unlike traditional VLANs that segment at a coarse level, micro-segmentation applies policies at the workload or application level — often down to individual containers or virtual machines. Traffic is denied by default, and only permitted flows are explicitly allowed.

Network traffic flows in two directions. North-south traffic flows between users/internet and internal resources (vertical). East-west traffic flows between workloads inside the data center (horizontal). Traditional firewalls primarily inspect north-south traffic. Micro-segmentation focuses on east-west traffic — the path attackers use to move between internal systems after initial compromise.

Software-Defined Networking (SDN) separates the control plane (decisions about where traffic goes) from the data plane (actual forwarding of packets). A centralized SDN controller programs network devices with forwarding rules, enabling micro-segmentation to be implemented in software without reconfiguring physical switches. This makes policy changes fast, consistent, and auditable across large environments.

A Software-Defined Perimeter (SDP) makes network resources invisible by default — they do not respond to unauthenticated connection attempts. Users first authenticate to an SDP controller, which checks identity and device posture, then dynamically creates an encrypted tunnel only to the specific resources they are authorized to access. This eliminates network-level reconnaissance and lateral movement paths.

Zero Trust Network Access (ZTNA) is the product category that implements SDP concepts. Unlike a VPN that grants broad network access, ZTNA grants access to specific applications only. The user connects to a ZTNA broker that authenticates identity and device, then proxies connections to the target app. Popular implementations include Cloudflare Access, Zscaler Private Access, and Palo Alto Prisma Access.

Cloud platforms offer native micro-segmentation tools. AWS Security Groups allow precise inbound and outbound rules per EC2 instance. Azure NSGs (Network Security Groups) apply at the subnet or NIC level. Google VPC Firewall Rules can be scoped to tags. All operate on an implicit-deny model — only explicitly permitted traffic flows, making them natural building blocks for micro-segmentation in cloud environments.

In containerized environments, service meshes like Istio and Linkerd implement micro-segmentation through mutual TLS (mTLS) between pods. Every service-to-service call is authenticated and encrypted, and authorization policies explicitly define which services may communicate. This extends Zero Trust east-west controls all the way down to individual microservices in Kubernetes clusters.

Traditional network segmentation uses VLANs, DMZs, and subnets to create broad security zones. Micro-segmentation is far more granular — policies apply at the workload or process level, not the subnet level. A VLAN might contain 50 servers all trusted to communicate; micro-segmentation ensures that only specific servers in that VLAN can reach specific ports on specific peers, shrinking lateral movement paths dramatically.

Effective micro-segmentation requires comprehensive visibility into existing network flows before policies are applied. Discovery tools map actual communication patterns between workloads. A common approach is to deploy in monitor mode first — observe all traffic, generate proposed policies — then switch to enforce mode to deny unauthorized flows. This prevents accidentally blocking legitimate traffic during rollout.

The primary security benefit of micro-segmentation is reducing blast radius. If an attacker compromises a workstation in the sales VLAN, micro-segmentation policies prevent that workstation from communicating with the finance database, the HR system, or domain controllers. The attacker remains isolated to the segment they landed in, making the incident easier to contain and remediate before widespread damage occurs.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: micro-segmentation divides networks at the workload level to limit lateral movement, software-defined perimeters make resources invisible until identity is verified, and ZTNA replaces VPNs by granting application-level access rather than network-level access. Next up we explore how identity becomes the new perimeter through conditional access policies.