Skip to content

Intermediate · Identity and network defence · topic 19 of 43 · 30 min

Network segmentation, zero trust and VPNs

Explanation

Segmentation splits a network into zones, so an attacker who gets into one part cannot reach everything. A DMZ holds internet-facing servers, VLANs separate groups of devices, and zero trust checks every request instead of trusting the network. VPNs create encrypted tunnels for remote staff and between offices, and must themselves be patched and protected with MFA.

Why flat networks are dangerous

In a flat network, every device can talk to every other device. If one laptop is infected, the attacker can reach every server, camera and database. Ransomware spreads fastest in flat networks. Segmentation limits the "blast radius" of a break-in.

Think of it like this: A ship is built with watertight compartments. If one compartment floods, doors close and the ship stays afloat. Network segments are those compartments.

Zones and the DMZ

A zone is a group of systems with similar trust and purpose. Firewalls between zones allow only the traffic each zone needs.

ZoneContainsMay talk to
InternetEveryoneOnly the DMZ, on 80/443
DMZ (demilitarised zone)Public web servers, mail gatewayOnly the specific app servers it needs
User LANStaff laptopsInternet via proxy, internal apps
Server zoneApp and database serversEach other on specific ports only
ManagementAdmin tools, jump hostsEverything, but only admins can reach it, with MFA
Guest Wi-Fi and IoTVisitors, cameras, printersInternet only

VLANs (virtual LANs) split one physical switch into several separate networks, so you can segment without separate cables. Traffic between VLANs goes through a router or firewall where rules apply.

Zero trust

Zero trust is a security model that says: never trust a request just because it comes from inside the network; always verify. Each access is checked using who the user is, whether their device is healthy, and what they are asking for. Micro-segmentation applies rules down to single workloads. NIST describes the model in SP 800-207.

  • Verify explicitly: strong authentication and device checks on every access.
  • Least privilege: just enough access, just in time.
  • Assume breach: design as if an attacker is already inside; segment and monitor.

VPNs

A VPN (virtual private network) creates an encrypted tunnel over the internet. Two common types:

  • Remote-access VPN: a staff laptop connects to the office network from home. Common protocols: IPsec, OpenVPN, WireGuard, and TLS-based VPNs from firewall vendors.
  • Site-to-site VPN: two offices or an office and a cloud network are joined by a permanent tunnel, usually IPsec.

Split tunnelling sends only office traffic through the VPN and the rest directly to the internet. It saves bandwidth but means that traffic is not inspected by company security tools.

Zero trust network access (ZTNA) is a newer approach: instead of putting the user "on the network", it connects them to one specific app after checking identity and device every time.

Careful: VPN gateways face the internet, so they are prime targets. Many large breaches in recent years started with an unpatched VPN appliance or a VPN account without MFA. Patch VPN devices quickly when security updates are released, and always require MFA.

Consumer VPN apps

Consumer VPN apps hide your traffic from the local Wi-Fi and your ISP, but the VPN company can see it instead. They do not make you anonymous and do not stop phishing or malware.

Common mistakes

  • Segmenting on paper but allowing "any any" between zones.
  • Putting printers, cameras and staff laptops on the same network as servers.
  • VPN accounts for leavers left active.
  • Thinking VPN equals security. It only protects the path, not the endpoints at each end.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

Network segmentation, zero trust and VPNs · 1/7

Flat network = big blast radius

In a flat network, one infected laptop can reach everything.

Prefer a video by a teacher? Find free videos on “network segmentation DMZ VLAN zero trust explained” on YouTube ↗

In real life: The CCTV camera that reached the server

At a retail chain, cheap CCTV cameras were on the same network as the billing servers. Attackers took over a camera with a default password and used it to reach a billing server. After the incident, cameras were moved to their own VLAN that can only reach the video recorder, billing servers got their own zone reachable only from the billing app, and admin access moved to a jump host with MFA.

Practice (0/3 done)

Task 1 · Question

Where should a company's public website server be placed?

Task 2 · Code · Python

Zone policy check. POLICY maps (source_zone, dest_zone) to a set of allowed ports. Write allowed(src_zone, dst_zone, port) that returns True only if that pair exists in POLICY and the port is in its set. Everything else is denied.

Task 3 · Practice

Draw (on paper or in a tool) a segmented network for a small clinic with: reception PCs, doctors' laptops, a patient records server, a public website, guest Wi-Fi, and CCTV cameras. Mark the zones and which traffic is allowed between them.

Quick quiz

Question 1

1.What is the main benefit of segmentation?

Question 2

2.Which NIST publication describes zero trust architecture?

Question 3

3.A VPN that permanently joins two offices is…

Question 4

4.What does a VLAN do?

Question 5

5.Why are VPN appliances high-value targets?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

What is the main benefit of segmentation?

Answer: It limits how far an attacker can move after getting in

Segments contain the blast radius.

Which NIST publication describes zero trust architecture?

Answer: SP 800-207

NIST SP 800-207 is "Zero Trust Architecture".

A VPN that permanently joins two offices is…

Answer: Site-to-site

Site-to-site VPNs link networks, usually with IPsec.

What does a VLAN do?

Answer: Splits one physical switch into separate logical networks

VLANs separate traffic logically; firewalls control what crosses between them.

Why are VPN appliances high-value targets?

Answer: They face the internet and give access to the internal network

One unpatched VPN device or MFA-less account can open the whole network.

An employee working from a hotel connects her laptop to the office. What type of VPN is that?Related

Answer: Remote-access

A single user connecting with a VPN client uses a remote-access VPN.

From Firewalls, IPS and VPNs

An IP phone and a PC share one switch port. Which command puts the phone traffic in VLAN 50?Related

Answer: switchport voice vlan 50

switchport voice vlan 50 tells the phone to tag voice frames with VLAN 50; the PC stays in the access VLAN.

From VLANs: what they are and why we use them

Which statement about network ACLs is true?Related

Answer: They are stateless and evaluated in rule-number order

NACLs are stateless subnet firewalls; the lowest numbered matching rule decides.

From VPC security and connectivity

Which statement about security groups and network ACLs is true?Related

Answer: Security groups are stateful; network ACLs are stateless

Security groups remember connections, so replies are allowed automatically. Network ACLs are stateless, have allow and deny rules, and apply to a subnet.

From Virtualisation, VRFs and cloud networking

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: Logs and log sources →

Next steps

  1. This is the last topic of “Identity and network defence”. The module exam comes next.
  2. Module 4 exam: Identity and network defence · 12 questions · 20 min, without help. 4 topics of this module still to finish first.
  3. Then the next module, Logs, SIEM and incident response. 43 topics left in the course before the final exam.

← Previous: Intrusion detection and prevention (IDS/IPS)