Network Segmentation and Zero Trust Basics

Traditional network security assumed that everything inside the network perimeter was trusted. Modern threats — insider attacks, compromised credentials, lateral movement after a breach — require a different model: Zero Trust ('never trust, always verify') and network segmentation. Network segmentation divides the network into zones based on sensitivity and function. Example zones: corporate LAN (office computers), servers (file servers, AD), VoIP, guest Wi-Fi, IoT devices. Firewall rules control what can communicate between zones — only allow necessary traffic. If an attacker compromises a workstation, segmentation limits their ability to reach the server zone. Zero Trust extends this concept: every access request is verified regardless of network location. Core principles: verify identity explicitly (MFA), use least-privilege access (minimum permissions needed), assume breach (monitor and log everything as if the network is already compromised). Implementing Zero Trust is a journey, not a single product. Start with MFA, device compliance checking (Intune), and conditional access policies in Microsoft 365.