Cyber Security Academy · Lesson

Microsegmentation and Network Policy

Replace perimeter firewalls with microsegmented zones and enforce least-privilege network access.

Microsegmentation and Network Policy is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is Microsegmentation?

Microsegmentation divides a network into small, isolated segments with granular access controls between them. Unlike traditional VLAN segmentation at the network boundary, microsegmentation enforces policies at the individual workload or application level.

Why Microsegmentation Matters

Once an attacker is inside a flat network, lateral movement is unconstrained. Microsegmentation limits blast radius:

Compromised workstation cannot reach the database directly
Each segment has minimum required communication allowed
East-west traffic is inspected and controlled

Traditional Segmentation Limitations

Traditional firewall-based segmentation:

North-south: traffic between internet and DMZ — well controlled
East-west: traffic between internal systems — often flat and uncontrolled

Most lateral movement exploits the trust in east-west traffic. Microsegmentation addresses this gap.

Software-Defined Networking (SDN)

SDN decouples network control (software) from data forwarding (hardware). This enables programmatic policy enforcement. Microsegmentation platforms (Illumio, VMware NSX, Guardicore) use SDN principles to apply workload-level policies.

Kubernetes Network Policies

In Kubernetes, NetworkPolicies control pod-to-pod communication:

# Allow only frontend pods to reach backend on port 8080:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - port: 8080

AWS Security Groups as Microsegmentation

AWS Security Groups function as microsegmentation:

Each instance has its own security group
Rules reference other security groups (not just IP ranges)
Only allow explicitly needed traffic between resources
Principle: default deny, explicit allow

Zero Trust Network Access (ZTNA)

ZTNA (Zscaler, Cloudflare Access) applies Zero Trust at the application level:

Users access specific apps, not the entire network
No network-level visibility into the internal network
Each app access requires identity verification

ZTNA is microsegmentation extended to user access.

Service Mesh for Microservices

Service meshes (Istio, Linkerd, Consul) implement microsegmentation at the microservice level using mTLS between every service-to-service call:

Every call is authenticated and encrypted
Authorization policies control which services can call which
Observability: full traffic visibility

Defining a Microsegmentation Policy

Building a microsegmentation policy:

Discover all workloads and their communication patterns
Map which flows are legitimate vs unexpected
Start in monitor mode — see what would be blocked
Enforce policies gradually, starting with highest-risk segments
Move to default deny for unauthorized flows

Monitoring East-West Traffic

Tools for east-west traffic visibility:

VPC Flow Logs (AWS) — network-level flows
Service mesh telemetry — per-RPC visibility
NSX Distributed Firewall logs
Zeek/Suricata on tap interfaces for full packet inspection

Microsegmentation Challenges

Implementation challenges:

Legacy applications with undocumented communication patterns
Performance overhead of per-workload policy enforcement
Policy complexity management at scale (hundreds of services)
Requires good asset inventory to segment effectively

Quick Check: Microsegmentation

In Kubernetes, what resource type controls which pods can communicate with each other at the network level?

Lesson Recap

Microsegmentation applies granular access controls between individual workloads, limiting lateral movement blast radius. Tools: Kubernetes NetworkPolicy, AWS Security Groups, service meshes (Istio), ZTNA, and dedicated platforms (Illumio, NSX). Implementation: discover flows, monitor mode first, then enforce default-deny. East-west traffic visibility via VPC Flow Logs and service mesh telemetry.

Frequently asked questions

Is the “Microsegmentation and Network Policy” lesson free?

Yes — the full text of “Microsegmentation and Network Policy” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Microsegmentation and Network Policy”?

Replace perimeter firewalls with microsegmented zones and enforce least-privilege network access. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Microsegmentation and Network Policy” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

Zero Trust Principles and the BeyondCorp Model
Identity and Device Verification
Microsegmentation and Network Policy
Continuous Validation and Monitoring

← Back to Cyber Security Academy