On a flat network, one compromised laptop can reach the domain controller, the backups and the crown jewels. Segmentation breaks the network into zones so a single foothold isn't game over.
What it buys you
- Smaller blast radius - an attacker in one zone can't freely reach another.
- Detectable crossings - traffic between zones passes controlled chokepoints you can monitor and alert on. Lateral movement becomes a signal instead of invisible.
- Enforced least privilege - only the flows that should exist are allowed (e.g. workstations don't need to talk to each other).
How to segment
- By trust/function - separate user, server, management, OT, and PCI/sensitive zones.
- Choke the flows - default-deny between zones; allow only required ports/services.
- Protect the crown jewels - DCs, backups and databases behind the tightest controls, reached only from a hardened jump host.
- Micro-segmentation - down to the workload level in modern/cloud environments.
The detection payoff
Once east-west traffic is constrained, unexpected east-west traffic is high-signal. Baseline who-talks-to-whom, and a workstation suddenly opening SMB/WinRM to a file server at 2am lights up. Segmentation and detection reinforce each other.