Glossary
Network segmentation
Dividing a network into separate zones so a compromise in one place can’t freely reach everything else.
Also called Microsegmentation, Zero trust.
In plain terms
On a flat network, one stolen login can reach almost anything: payment systems, admin tools, backups. Segmentation draws boundaries so each account and vendor reaches only what its job needs.
The backups deserve their own zone. Attackers increasingly go after them first, because encrypted production plus deleted backups leaves no way out.
See what happens without it
The failure pattern this protects against, insufficient segmentation lets a foothold spread, played out step by step.
Scroll the diagram sideways to see every system.
One foothold, total compromise, backups included.
What goes wrong:
- An attacker phishes a contractor’s VPN login.
- The network is flat, so that one login reaches everything.
- From the management plane it reaches the data and the backups.
- One foothold, total compromise, backups included.
With the safeguard:
- An attacker phishes a contractor’s VPN login.
- The contractor can reach only the one system they support.
- Management and backups are isolated, with separate credentials.
- The breach stays contained to one system.
When it mattered
In 2013 attackers used credentials stolen from a heating and ventilation contractor to reach Target’s network and then its point-of-sale systems, taking card data for about 40 million accounts.