Network Segmentation: Why One Infected Laptop Becomes a Company-Wide Incident

Ask what happened after a serious ransomware incident and the answer is rarely a clever exploit. It is that one laptop was compromised, and from that laptop every file server, every domain controller and every backup target was directly reachable.

Segmentation is the control that changes the blast radius. It does not prevent the first compromise. It decides whether the first compromise is an afternoon of cleanup or a month of rebuilding.

Why flat networks persist

Flat networks are not the result of ignorance. They are the result of everything working. Any device can reach any service, so nothing ever breaks for a connectivity reason, and nobody has to maintain rules.

The cost is invisible until an incident, at which point it is the whole story.

Start with what an attacker needs, not with VLANs

Segmentation projects stall when they begin as a network redesign. They succeed when they begin as a list of paths that should not exist.

Three paths deserve attention before anything else:

• Workstation to workstation. There is almost no legitimate reason for one employee laptop to open an SMB or RDP session to another. This single rule removes the most common lateral movement technique in commodity attacks.
• Workstation to server management ports. Administration should come from a defined set of hosts, not from whichever laptop an administrator happens to be using.
• Anything to backups. Backup infrastructure should be reachable only from the backup system itself. If a compromised file server can delete the backups, you do not have backups.

Each of these can be implemented without redesigning addressing.

Segment by trust, not by department

Dividing the network by team produces zones with identical trust levels and no security benefit. Divide instead by what a compromise would mean:

• User devices, which are assumed to be compromised at some point.
• Servers, split between internet-facing and internal.
• Management and administrative infrastructure.
• Backup and recovery.
• Operational technology, cameras, printers, building systems — devices that cannot be patched and should be isolated for that reason.
• Guest and bring-your-own devices, which should reach the internet and nothing else.

Printers and IP cameras deserve a specific mention. They are rarely updated, frequently ship with default credentials, and sit on the same network as everything else. They are a reliable foothold.

Deliver it in stages

A phased approach survives contact with the business:

1. Observe. Log flows without blocking. You will discover dependencies nobody documented.
2. Isolate the easy wins. Guest networks, printers, cameras and building systems rarely need to reach anything internal.
3. Block workstation-to-workstation. High impact on attacker mobility, low impact on users. Host firewall policy is often the fastest route.
4. Restrict administrative access to defined management hosts.
5. Isolate backups, ideally with credentials that domain administrators do not hold.
6. Then consider finer segmentation between application tiers.

The identity layer matters as much as the network

Network segmentation that leaves a single administrative account valid everywhere has moved the problem, not solved it. Separate administrative identities from daily-use accounts, and do not let an account that administers workstations also administer servers.

Test it rather than assuming it

Firewall rules drift, temporary exceptions become permanent, and a rule added for a migration three years ago is still there. Verify the boundaries hold by attempting the connections that should fail, and repeat that check on a schedule.

The question worth being able to answer: if a laptop in the sales team were compromised right now, exactly what could it reach? If the answer takes more than a few minutes to work out, the segmentation exists on a diagram rather than in the network.

Frequently asked questions