COMP 6660 · Enterprise Cybersecurity Firewalls and Segmentation

00 Introduction

Lesson 4.4 examined how enterprises extend their networks across public infrastructure. This lesson examines the controls that determine what traffic is permitted within the enterprise estate — the firewalls that enforce policy at boundaries, and the segmentation that divides the estate into zones with distinct trust levels.

Firewalls and segmentation are among the oldest and most consequential controls in enterprise security. Firewalls have been deployed at enterprise perimeters since the early 1990s; segmentation has been a design principle for as long as enterprises have had internal networks. Their importance has grown as the perimeter has dissolved and as the interior of the estate has become the primary battleground for adversaries. Almost every documented enterprise breach has involved lateral movement — the adversary moving from an initial foothold to higher-value systems — and the effectiveness of segmentation determines how far that movement can go.

The material in this lesson builds directly on the architectural principles established in Lessons 4.1 and 4.2 and on the protocols examined in Lesson 4.3. Firewalls are the enforcement mechanism for network-layer policy; they determine what traffic crosses trust boundaries (Lesson 4.1) and provide one of the layers of defence-in-depth (Lesson 4.2). Segmentation is the architectural structure that determines where those boundaries are and what controls protect them.

This lesson examines firewalls and segmentation in detail. It establishes why they matter. It examines firewall fundamentals — what firewalls do and the generations of firewall technology. It examines deployment architectures — perimeter firewalls, internal firewalls, host-based firewalls, and cloud-native firewalls. It examines firewall policy and rule management as an operational discipline. It examines segmentation — its purpose, its approaches, and the shift to micro-segmentation. It examines east–west traffic control as the specific form that segmentation takes in modern estates. And it closes with enterprise practice and the pitfalls that recur across organisations.

01 Learning objectives

By the end of this lesson you should be able to:

These objectives contribute to Unit 4 outcomes U4.1 (architecture design) and U4.3 (control recommendation), and to Module 2 outcomes M2.5 and M2.7. See the Unit 4 learning outcomes page for the full mapping.

02 Why firewalls and segmentation matter

Firewalls and segmentation are the controls through which enterprises determine what traffic is permitted across the trust boundaries identified in Lesson 4.1. They matter for several reasons.

The changing context

The role of firewalls and segmentation has changed as the enterprise estate has evolved:

• The perimeter has dissolved. Firewalls at the enterprise perimeter remain useful, but they are no longer the primary line of defence. The modern adversary operates through credentials, third parties, and cloud services — bypassing perimeter controls entirely.
• The interior has become the battleground. With the perimeter no longer providing meaningful defence, what happens inside the enterprise estate determines the outcome of most incidents. Segmentation is the control that determines how far an adversary can move once inside.
• East–west traffic dominates. In modern distributed architectures, most traffic is between workloads, services, and internal systems — not between the enterprise and the internet. Traditional perimeter firewalls do not see this traffic; internal firewalls and micro-segmentation are required.
• Cloud has changed the deployment model. Firewalls in cloud environments are frequently cloud-native — virtual firewalls, security groups, network policies — and require different configuration and management than traditional appliances.
• Identity-based controls complement network controls. Identity-based access control (Module 1, Lessons 2.5–2.7) provides fine-grained access decisions that network controls alone cannot; the two are complementary, not alternatives.

03 Firewall fundamentals

A firewall is a network security control that monitors and controls incoming and outgoing network traffic based on defined security rules. Firewalls are the primary mechanism through which enterprises enforce network-layer policy at boundaries.

What firewalls do

• Enforce policy. Firewalls determine what traffic is permitted based on rules — source, destination, protocol, port, and, in modern firewalls, application identity and content.
• Separate trust levels. Firewalls are deployed at trust boundaries, where the level of trust changes — between the enterprise and the internet, between different internal zones, between different privilege levels.
• Log and audit. Firewalls log traffic decisions — what was permitted, what was denied — providing evidence for security monitoring and compliance.
• Provide detection. Modern firewalls integrate detection capabilities — intrusion detection, application identification, threat intelligence — providing visibility into network activity.
• Enforce segmentation. Firewalls enforce the policies that determine what traffic may cross between segments — the mechanism through which segmentation is operationalised.

What firewalls do not do

Firewalls are frequently expected to provide protections they do not offer. Clarifying the limits:

• They do not detect all attacks. Firewalls enforce traffic policy; they do not detect attacks that use permitted traffic. A firewall that permits HTTPS cannot distinguish legitimate HTTPS from malicious HTTPS.
• They do not protect against compromised credentials. A firewall that permits a user to access a system permits an attacker with the same credentials to access the same system.
• They do not provide application-level protection. Traditional firewalls operate at the network and transport layers; they do not understand application logic. Application-level attacks use permitted traffic and are not stopped by firewalls.
• They do not protect against insider threats. Firewalls control traffic across boundaries; they do not control what users with legitimate access do within a boundary.
• They do not protect against attacks that do not use the network. Physical attacks, supply chain compromise, and social engineering bypass firewalls entirely.

The firewall's position in the architecture

Firewalls are deployed at trust boundaries, as established in Lesson 4.1. Their effectiveness depends on where they are placed and what policy they enforce. Common placements include:

• Perimeter. Between the enterprise and the internet — the classic firewall position. Controls what enters and leaves the enterprise.
• Internal. Between internal zones — between different security domains (Lesson 4.1), between different privilege levels, between different business functions. Controls lateral movement within the estate.
• Host. On individual systems — host-based firewalls that control what traffic the system accepts or sends. Provides a layer of defence independent of network firewalls.
• Cloud. In cloud environments — virtual firewalls, security groups, network policies that control traffic between cloud resources.
• Application. Within applications — web application firewalls that inspect HTTP/HTTPS traffic for application-level attacks.

In modern architectures, multiple firewalls are deployed at multiple boundaries. A single perimeter firewall is insufficient for the reasons established in Lesson 4.2 — the perimeter is not the only trust boundary, and an adversary who crosses it faces further controls only if those controls exist.

04 Firewall generations

Firewall technology has evolved through several generations, each adding capabilities that address the limitations of the previous generation. Understanding the generations clarifies the capabilities of modern firewalls and the gaps that legacy firewalls leave.

First generation — packet filters

The earliest firewalls were packet filters — they examined individual packets and made permit/deny decisions based on:

• source IP address;
• destination IP address;
• protocol (TCP, UDP, ICMP);
• source and destination ports.

Packet filters were stateless — each packet was evaluated independently, with no awareness of connection state. This made them vulnerable to attacks that exploited the stateless evaluation, and limited their ability to enforce meaningful policy. Packet filters are largely obsolete in modern enterprises, though some legacy devices remain in operation.

Second generation — stateful inspection

The second generation introduced stateful inspection — the firewall maintains state about active connections, allowing it to make decisions based on context rather than on individual packets alone. A stateful firewall can:

• track the state of each connection;
• permit return traffic for permitted outbound connections;
• detect and block packets that do not fit an established connection;
• detect some classes of attacks (port scans, malformed packets).

Stateful inspection remained the dominant model for many years and continues to be the foundation of modern firewalls. But stateful firewalls still operate at the network and transport layers — they do not understand applications or content.

Third generation — application-layer firewalls

The third generation introduced application-layer inspection — the firewall understands the application protocols traversing it and can make decisions based on application content. Two sub-types emerged:

• Proxy firewalls. The firewall terminates the connection, examines the content, and establishes a new connection to the destination. Provides deep inspection but adds latency and complexity.
• Application firewalls. The firewall inspects application traffic in-line, without proxying. More efficient than proxies but requires application-specific understanding.

Application-layer firewalls enable policies that are impossible at lower layers — permitting specific HTTP methods, blocking specific URL categories, or detecting application-level attacks. Web application firewalls (WAFs) are a specific type of application-layer firewall focused on HTTP/HTTPS.

Fourth generation — next-generation firewalls (NGFW)

The current generation — next-generation firewalls (NGFW) — combines multiple capabilities in a single platform:

• Stateful inspection. The foundational capability.
• Application identification. Identifying applications by their behaviour, not just by port — allowing policy based on what an application is, not just what port it uses.
• User identification. Identifying users behind traffic — integrating with identity systems to make policy based on user identity, not just IP address.
• Content inspection. Inspecting content for malware, sensitive data, and threats.
• Intrusion prevention. Integrated IPS functionality (Lesson 4.6).
• Threat intelligence. Integration with threat intelligence feeds to identify and block known-malicious activity.
• SSL/TLS inspection. Decryption, inspection, and re-encryption of TLS traffic to identify threats within encrypted connections.
• Logging and analytics. Rich logging and analytics of firewall activity.

NGFWs are the dominant firewall technology in modern enterprises. They provide capabilities that legacy firewalls cannot — application identification, user identification, content inspection, and integrated threat prevention — enabling policies that are more effective and more granular.

The evolution of firewall capabilities

05 Firewall deployment architectures

Firewalls are deployed at multiple points in the enterprise architecture. Each deployment type provides distinct capabilities and serves distinct purposes.

The layered firewall architecture

Modern enterprises deploy firewalls at multiple layers, each providing distinct protection:

• Perimeter firewalls. Control ingress and egress at the enterprise boundary.
• Internal firewalls. Control traffic between internal zones, enforcing segmentation policy.
• Cloud-native firewalls. Control traffic in cloud environments — between cloud resources and between cloud and on-premises.
• Web application firewalls. Control application-layer traffic to web applications.
• Container firewalls. Control traffic between containers and services.
• Host-based firewalls. Control traffic on individual systems, providing a layer of defence independent of network controls.

The layered approach provides defence-in-depth at the network layer — if one firewall is bypassed, the others remain. It also provides granular control — each layer can enforce policies appropriate to its position and purpose. And it supports Zero Trust — each layer verifies traffic rather than trusting it by virtue of its origin.

06 Firewall policy and rule management

A firewall is only as effective as its policy. The rules that define what traffic is permitted determine what the firewall actually does; poorly managed rules undermine the firewall regardless of its technology.

Firewall policy principles

Common firewall policy problems

• Any–any rules. Rules that permit all traffic from any source to any destination — typically added "temporarily" for troubleshooting and never removed.
• Broad source or destination ranges. Rules that permit traffic from entire subnets when specific hosts would suffice.
• Unused rules. Rules that no longer match any traffic — either because the systems they referenced are retired or because policy has evolved — but remain in place.
• Shadowed rules. Rules that are never matched because a more general rule earlier in the order permits the traffic first.
• Undocumented rules. Rules whose purpose is not known, making it impossible to determine whether they are still needed.
• Rule drift. Rules accumulated over time through incremental changes, without review or consolidation.
• Inconsistent rules across firewalls. Different firewalls enforcing inconsistent policies, creating gaps or conflicts.
• No rule review process. Rules added but never reviewed, producing steady accumulation of unmanaged policy.

Firewall rule lifecycle management

Effective firewall policy management treats rules as a lifecycle:

07 Segmentation fundamentals

Segmentation is the practice of dividing the enterprise estate into distinct zones, each with its own trust level and its own access controls. It is the architectural structure that determines what an adversary who has established a foothold can reach.

What segmentation provides

• Limited lateral movement. An adversary who compromises one zone cannot freely move to other zones; each crossing requires defeating the controls at the boundary.
• Reduced blast radius. The consequence of any single compromise is limited to the compromised zone, rather than the whole estate.
• Differential protection. Different zones can be protected according to their sensitivity — high-value zones can be protected more strongly than low-value zones.
• Containment. When an incident occurs, containment is easier — the affected zone can be isolated without taking the whole estate offline.
• Compliance. Many regulatory frameworks require segmentation of sensitive data or systems — PCI DSS, HIPAA, and others include segmentation requirements or benefits.
• Detection. Traffic between zones is visible at the boundaries; anomalous traffic can be detected and investigated.

Segmentation design principles

Segmentation and Zero Trust

Segmentation is one of the principal technical mechanisms through which Zero Trust is realised. Zero Trust requires that no subject or network be trusted by default — including the enterprise's own internal networks. In a segmented architecture, this principle is operationalised: traffic between segments is explicitly controlled, and no segment is trusted by virtue of being inside the enterprise.

The shift to Zero Trust has driven the shift from coarse segmentation (a few large zones) to fine-grained segmentation (many small zones) — culminating in micro-segmentation, examined in Section 8. The goal is to limit the blast radius of any single compromise as much as possible, rather than to rely on a small number of trust boundaries.

08 Segmentation approaches

Segmentation can be implemented at several layers, from network-level segmentation to identity-based micro-segmentation. The approaches are complementary — a comprehensive segmentation architecture uses multiple approaches together.

Network-level segmentation

Network-level segmentation divides the network into distinct zones using network devices — VLANs, subnets, and firewalls.

• VLANs. Virtual LANs separate devices at the data-link layer, creating logical network segments that behave as separate physical networks. VLANs are widely used but provide only data-link-layer isolation — traffic between VLANs is routed, requiring router or firewall controls.
• Subnets. IP subnets divide the network at the network layer. Traffic between subnets is routed; controls at the routing points (firewalls, routers with ACLs) determine what is permitted.
• Firewalls. Firewalls between zones enforce the policy that determines what traffic may cross. Firewalls are the primary enforcement mechanism for network-level segmentation.
• DMZ (demilitarized zone). A specific pattern — public-facing services are placed in a separate zone (the DMZ) that is separated from internal systems. Services in the DMZ can be reached from the internet but cannot directly reach internal systems.

Identity-based segmentation

Identity-based segmentation controls access based on identity and policy rather than network location. This is the approach that Zero Trust requires — access decisions based on who is requesting, not on where the request originates.

• Identity-aware proxies. Mediate access to resources, verifying identity and policy before establishing the connection. No network-level segmentation is required — access is controlled by identity.
• Software-defined perimeter (SDP). Hides resources from unauthorised subjects; access is brokered through a controller that establishes connections only when policy allows.
• Service mesh. In container and microservices environments, a service mesh provides identity-based access control between services — mutual TLS authentication, authorization policy, and observability.
• Zero-trust network access (ZTNA). Provides identity-based access to specific applications — a form of segmentation at the application layer rather than the network layer.

Cloud-native segmentation

Cloud-native segmentation uses the cloud provider's native controls to segment cloud environments.

• Virtual private clouds (VPCs). Isolated network environments within the cloud provider. VPCs provide network-level isolation.
• Subnets. Subdivide VPCs; public subnets and private subnets have different characteristics.
• Security groups. Instance-level firewalls that control what traffic each instance accepts. Security groups are the primary cloud-native segmentation mechanism.
• Network ACLs. Subnet-level firewalls that control what traffic crosses subnet boundaries.
• VPC peering and transit gateways. Control connectivity between VPCs and between cloud and on-premises environments.
• Service endpoints and private links. Provide private access to cloud services without traversing the public internet.

Application and workload segmentation

Beyond network and identity segmentation, applications and workloads can be segmented through:

• Application-level authorization. Each application enforces its own authorization policy — determining what each authenticated user can access within the application.
• Data-level controls. Data is segmented by classification — access to different data sets is controlled separately.
• Container policies. Kubernetes network policies, pod security policies, and service mesh authorization control traffic between containers and services.
• Workload identity. Each workload has a distinct identity and access policy — no workload is trusted by virtue of its position.

09 Micro-segmentation in depth

Micro-segmentation is the practice of dividing the enterprise estate into very small zones — typically individual workloads, services, or applications — each with its own access controls. Micro-segmentation is the fine-grained form of segmentation, and one of the principal technical mechanisms through which Zero Trust is realised.

What micro-segmentation provides

• Very limited lateral movement. An adversary who compromises one workload cannot freely move to adjacent workloads; each crossing requires defeating the controls at the boundary.
• Fine-grained blast radius. The consequence of any single compromise is limited to the compromised workload — not the zone, not the estate.
• Workload-level policy. Access policy is defined per workload, based on the specific traffic that workload requires — implementing least privilege at the network layer.
• Visibility into communication patterns. Micro-segmentation requires understanding what workloads communicate with each other — providing visibility that traditional network segmentation does not.
• Support for Zero Trust. Micro-segmentation is one of the concrete technical implementations of the Zero Trust principle at the network layer.

Micro-segmentation approaches

Micro-segmentation implementation

Implementing micro-segmentation is a substantial undertaking. The standard approach proceeds through several phases:

10 East–west traffic control

East–west traffic is traffic between systems within the enterprise estate — as opposed to north–south traffic, which enters or leaves the estate. East–west traffic control is the specific form that segmentation takes in modern architectures, and it is one of the most consequential areas of enterprise network security.

Why east–west traffic matters

• East–west traffic dominates modern estates. In distributed architectures — microservices, container environments, cloud workloads — most traffic is between internal systems, not between the enterprise and the internet.
• Traditional perimeter controls do not see east–west traffic. Perimeter firewalls see only north–south traffic; internal traffic is invisible to them.
• Lateral movement happens in east–west traffic. An adversary who has established a foothold moves through the estate via east–west traffic; the controls that determine what they can reach are the east–west controls.
• Modern attacks target east–west traffic. Adversaries have recognised that east–west traffic is frequently less monitored and less controlled than north–south — and target it accordingly.

East–west traffic control mechanisms

Designing east–west traffic control

Effective east–west traffic control combines multiple mechanisms:

• Understand the traffic. Discovery — what workloads communicate with what, over what protocols and ports — is the foundation. Without accurate visibility, policy cannot be designed.
• Define policy based on least privilege. Permit only the traffic each workload requires; deny everything else by default.
• Layer the controls. Combine network-based controls (firewalls, micro-segmentation) with identity-based controls (service mesh authorization, workload identity) and host-based controls (host firewalls). Layering provides depth.
• Integrate with monitoring. East–west traffic should be monitored for anomalies — unusual patterns, unusual destinations, unusual volumes. Detection complements prevention.
• Encrypt internal traffic. The assumption that internal traffic is safe because it stays inside is invalid. Encrypt east–west traffic where feasible.
• Maintain policy over time. East–west traffic patterns change as workloads change. Policy must be reviewed and updated.

11 Enterprise practice and pitfalls

Enterprise firewall and segmentation programmes fail in predictable ways. Recognising the pitfalls accelerates improvement.

Pitfall 1 — Perimeter-only firewalls

Deploying firewalls only at the enterprise perimeter, leaving the interior undefended. The interior has become the primary battleground; perimeter-only firewalls do not address east–west traffic.

Mitigation: Deploy firewalls at internal trust boundaries as well as at the perimeter. Implement segmentation and micro-segmentation to control east–west traffic.

Pitfall 2 — Legacy firewalls without modern capabilities

Operating firewalls that do not provide application identification, user identification, content inspection, or integrated threat prevention. Legacy firewalls cannot enforce modern policies.

Mitigation: Assess firewall capabilities. Where legacy firewalls remain in operation, plan for replacement or supplement them with additional controls.

Pitfall 3 — Rule accumulation and drift

Firewall rules accumulated over time — broad, undocumented, obsolete, or unused — producing effective policy that is much more permissive than the enterprise believes.

Mitigation: Establish rule lifecycle management. Review rules periodically. Remove rules that are no longer needed. Use analysis tools to identify issues.

Pitfall 4 — Any–any rules

Rules that permit all traffic from any source to any destination — typically added for troubleshooting and never removed. They defeat the purpose of the firewall.

Mitigation: Identify any–any rules through policy analysis. Justify each; where they cannot be justified, remove them.

Pitfall 5 — No segmentation at all

Treating the enterprise estate as a flat network with no segmentation — leaving the whole estate exposed from any single compromise.

Mitigation: Implement segmentation — starting with the most sensitive zones, then extending. Even coarse segmentation substantially reduces blast radius compared with a flat network.

Pitfall 6 — Segmentation without controls at boundaries

Defining segments but not deploying controls at the boundaries between them — producing segmentation in name only.

Mitigation: Ensure every segment boundary has a control — a firewall, an identity-aware proxy, or equivalent — that determines what traffic crosses.

Pitfall 7 — Micro-segmentation without discovery

Implementing micro-segmentation without adequate discovery of communication patterns — producing policy that breaks legitimate communication and generating outages.

Mitigation: Complete discovery before implementing policy. Deploy in monitoring mode first, verify policy correctness, then move to enforcement.

Pitfall 8 — No east–west traffic visibility

Monitoring north–south traffic while ignoring east–west traffic — providing visibility into what crosses the perimeter but not into what happens inside the estate.

Mitigation: Extend monitoring to east–west traffic. Use network detection, flow analysis, and service mesh observability to provide visibility into internal communication.

Pitfall 9 — Segmentation without documentation

Implementing segmentation without documenting the zones, boundaries, and controls — producing an architecture that no one fully understands and that cannot be maintained.

Mitigation: Document the segmentation architecture — the zones, the boundaries between them, and the controls at each boundary. Update the documentation as the architecture changes.

Pitfall 10 — Segmentation that ignores identity

Implementing network-level segmentation without integrating identity — treating all traffic from a zone as equivalent, without considering who is sending it.

Mitigation: Integrate identity-based controls with network-level segmentation. Use identity-aware proxies, service mesh authorization, and workload identity to provide finer-grained control than network location alone.

12 Key concepts

The terms below are used throughout Unit 4. Capture them in your own words as you work through the lesson.

Firewall

A network security control that monitors and controls incoming and outgoing network traffic based on defined rules. The primary mechanism through which enterprises enforce network-layer policy at boundaries.

Packet filter

First-generation firewall that examines individual packets and makes permit/deny decisions based on headers. Stateless; largely obsolete.

Stateful inspection

Second-generation firewall that tracks the state of connections, permitting return traffic for permitted outbound connections and detecting some classes of attacks.

Application-layer firewall

Third-generation firewall that understands application protocols and can make decisions based on application content. Includes proxies and application firewalls.

Next-generation firewall (NGFW)

Current-generation firewall that combines stateful inspection, application identification, user identification, content inspection, intrusion prevention, threat intelligence, and TLS inspection.

Web application firewall (WAF)

Specialised firewall that inspects HTTP/HTTPS traffic for application-level attacks — SQL injection, cross-site scripting, and other OWASP Top 10 attacks.

DMZ (demilitarized zone)

A network segment that sits between the enterprise's internal network and external networks. Public-facing services are placed in the DMZ, isolated from internal systems.

Firewall policy

The set of rules that determine what traffic the firewall permits and denies. Policy is only as effective as its management.

Default deny

A firewall policy that denies all traffic not explicitly permitted. The fail-safe default principle applied to network policy.

Rule shadowing

A condition in which a firewall rule is never matched because a more general rule earlier in the order permits the traffic first.

Segmentation

The practice of dividing the enterprise estate into distinct zones, each with its own trust level and its own access controls.

Micro-segmentation

Fine-grained segmentation — dividing the estate into very small zones, typically individual workloads or services, each with its own access controls.

VLAN

Virtual LAN — a network segmentation mechanism at the data-link layer, creating logical network segments that behave as separate physical networks.

East–west traffic

Traffic between systems within the enterprise estate — as opposed to north–south traffic, which enters or leaves the estate.

North–south traffic

Traffic between the enterprise and external networks — entering or leaving the estate. The traffic that perimeter firewalls see.

Security group

A cloud-native firewall that controls what traffic each cloud instance accepts. The primary cloud-native segmentation mechanism.

Network ACL

A cloud-native firewall that controls what traffic crosses subnet boundaries. Complements security groups in cloud environments.

Service mesh

A container and microservices control that provides identity-based access control between services — mutual TLS authentication, authorization policy, and observability.

Lateral movement

The techniques by which an adversary moves from an initial foothold to other systems within an environment. Segmentation and least privilege limit lateral movement.

Blast radius

The extent of impact from a single compromise. Reduced by segmentation, least privilege, and rapid detection.

13 Activities

The activities below help you test your understanding and prepare for the unit discussion and Assignment 2. They are not graded, but completing them will substantially improve your preparation.

14 Self-check

Answer the questions below before moving to Lesson 4.6. If you cannot answer a question confidently, revisit the corresponding section.

15 Summary

This lesson has examined firewalls and segmentation — the controls that determine what traffic crosses boundaries within the enterprise estate. The essential points are:

• Firewalls and segmentation matter because they determine what an adversary who has established a foothold can reach. They enforce network-layer policy, limit lateral movement, implement defence-in-depth, and support Zero Trust.
• Firewall technology has evolved through several generations. Packet filters; stateful inspection; application-layer firewalls; next-generation firewalls. NGFWs combine multiple capabilities — application identification, user identification, content inspection, intrusion prevention, threat intelligence, and TLS inspection.
• Firewalls are deployed at multiple points in the architecture. Perimeter firewalls; internal firewalls; host-based firewalls; cloud-native firewalls; web application firewalls; container and service mesh firewalls. The layered approach provides defence-in-depth at the network layer.
• Firewall policy management is an operational discipline. Default deny; least privilege; rule specificity; documentation. Rule accumulation and drift are the most consequential policy failures.
• Segmentation divides the estate into zones with distinct trust levels. It limits lateral movement, reduces blast radius, provides differential protection, supports containment and compliance, and enables detection.
• Segmentation can be implemented at multiple layers. Network-level (VLANs, subnets, firewalls, DMZs); identity-based (identity-aware proxies, SDP, service mesh); cloud-native (VPCs, security groups, network ACLs); application and workload.
• Micro-segmentation provides the finest granularity. Dividing the estate into very small zones — individual workloads or services — each with its own access controls. Micro-segmentation is one of the principal technical mechanisms for Zero Trust.
• East–west traffic control is the specific form that segmentation takes in modern estates. Most enterprise traffic is between internal systems; east–west traffic is where lateral movement happens; controlling it is essential.
• Common pitfalls recur. Perimeter-only firewalls; legacy firewalls; rule accumulation; any–any rules; no segmentation; segmentation without boundary controls; micro-segmentation without discovery; no east–west visibility; segmentation without documentation; segmentation that ignores identity.

These ideas prepare for Lesson 4.6, which examines intrusion detection and prevention — the technologies that identify attacks that firewalls and segmentation have not stopped, and that provide the detection layer of defence-in-depth.