Network Segmentation
Network segmentation divides a network into bounded zones with controlled transitions, so that one compromised system does not automatically reach every other. It is implemented through VLANs, separate routing domains, firewalls between zones and port-level access control. The BSI IT-Grundschutz module NET.1.1 requires, as a basic requirement, that the overall network be physically separated into at least three zones — internal network, DMZ and external connections — with the transitions secured by firewalls on an allowlist basis.
Network Segmentation in practice
Flat networks are the reason one infected laptop turns into a total outage: without boundaries between client, server, management and production networks, malware spreads unimpeded and backups sit in the same segment as production data. Segmentation answers this with zones. Basic requirement A4 of the BSI IT-Grundschutz module NET.1.1 demands physical separation of the overall network into internal network, DMZ and external connections, secured by an at least two-stage firewall structure that forwards only explicitly permitted communication; requirement A5 additionally demands that clients and servers sit in different network segments.
The usual technical basis is IEEE 802.1Q: the VLAN identifier is 12 bits wide, giving 4,094 usable VLANs per layer 2 domain, since 0 and 4095 are reserved. At the port, IEEE 802.1X decides which device may enter which segment at all. In OT environments IEC 62443 describes the same principle as zones and conduits.
A typical minimum structure covers clients, servers, management and out-of-band, backup, guest Wi-Fi, production or OT, and the DMZ. The backup zone deserves particular attention because it is the last safety net against ransomware. Microsegmentation takes this further, down to individual workloads. Segmentation is also a performance question: without sufficient bandwidth at the zone transitions the firewall becomes the bottleneck.
Alendris therefore plans segmentation together with the network upgrade — in one manufacturing project the server environment ended up with no direct internet access at all, with access routed by identity rather than through open network paths.