Protecting Networks: Segmentation
Introduced| English | Meaning |
|---|---|
| network segmentation/ˈnetwɜːk ˌseɡmənˈteɪʃn/ | network segmentation |
| subnets/ˈsʌbnets/ | Subdivisions of an IP network defined by their address prefixes. |
| screened subnet/skriːnd ˈsʌbnet/ | A separate network segment placed behind filtering controls to isolate exposed services from a more trusted internal network. |
| DMZ/ˌdiː em ˈzed/ | A network segment separating publicly reachable services from a more trusted internal network through controlled connections. |
| VLANs/ˈviːlænz/ | Logical local-area-network segments that separate groups of devices at the data-link layer despite shared physical infrastructure. |
Divide to contain
- Network segmentation 网络分段 splits one network into isolated subnets 子网.
- If one subnet is breached, the damage is contained.
- It cannot spread to the rest of the network.
The screened subnet (DMZ)
- A screened subnet 屏蔽子网 (a DMZ 隔离区) sits between the internet and the private network.
- It holds public-facing servers in a lower-security zone.
- This keeps public servers away from sensitive internal systems.
Server racks: network segmentation isolates systems so one breach does not open everything
Which network zone?
The DMZ holds public-facing servers; the private network holds sensitive systems; the internet is untrusted.
A DMZ (screened subnet) typically holds...
Difficulty 1/5 · 100 coins + a small bonus on first completion today
A DMZ holds public-facing servers.
The main security benefit of segmentation is that a breach is...
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Segmentation contains a breach.
Dividing a network into smaller isolated pieces creates ____.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Segmentation creates isolated subnets.
Which are ways to segment a network? (Choose all)
Difficulty 2/5 · 140 coins + a small bonus on first completion today
Deleting the firewall reduces security.
Ways to segment
- Subnetting divides by IP address.
- VLANs 虚拟局域网 logically separate devices on the same switch.
- Each segment can have its own security policy.
A flat, unsegmented network is dangerous: once an adversary is inside one device, nothing stops them reaching every other device. Segmentation builds internal walls that contain a breach.
VLANs can logically separate devices that share the same physical switch.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
VLANs separate devices logically.
A company puts its public web server in a DMZ between two firewalls. If the web server is hacked, the attacker is trapped in the DMZ — the second firewall still stands between them and the private customer database.
Network segmentation divides a network into isolated subnets so a breach stays contained. A screened subnet (DMZ) holds public-facing servers between the internet and the private network. Segment with subnetting or VLANs, each with its own policy.