Tutorial 1: Segmentation, Firewalls, and Zero Trust

Unit 4 · Network security

Objectives

Use segmentation to reduce attack paths and blast radius.
Distinguish network location from identity-based trust.
Write explicit allow rules and default-deny policy.

Traditional perimeter security assumes an internal network is trusted. Enterprise environments contain remote workers, cloud services, contractors, and compromised endpoints, so location alone is weak evidence. Zero-trust architecture continuously evaluates identity, device, resource, action, and context.

subject + device + action + resource + context -> policy decision
allow only required flow; log decision; re-evaluate sensitive actions

Segmentation separates systems by sensitivity, function, or tenant. Firewalls enforce traffic policy, but a firewall cannot compensate for weak application authorization. Rules should be narrow, ordered, documented, reviewed, and observable.

Exercises

Segment public web, API, database, and administration networks.
Write three deny-by-default rules and their business justification.
Identify what happens if one segment is compromised.

Self-check

Why is an internal network not automatically trusted?
What does segmentation limit?
Why log policy decisions?

Self-Check Quiz

1. What is the purpose of segmentation?

Answer

To limit reachable attack paths and reduce the blast radius of compromise.

2. What should default network policy do?

Answer

Deny traffic unless a specific, necessary, and reviewed rule allows it.

Homework

Design a zero-trust access path for an administrator.
Produce a segmented network diagram.
Explain one control that remains necessary after segmentation.

Sample answer

Require authenticated, managed-device administrator access to a narrowly scoped management service, with step-up MFA, time-limited elevation, and audit logs. Application authorization remains necessary because network reachability does not prove permission to view or change a record.