Network segmentation is the practice of dividing a computer network into smaller, isolated zones so that traffic between them can be controlled, inspected, or blocked. Instead of one flat network where any host can reach any other, segmentation creates boundaries enforced by VLANs, subnets, firewalls, or software-defined policy.
The security payoff is containment. If an attacker compromises a workstation in one segment, tight segmentation stops them from moving laterally into the database or cardholder environment. Retailers isolate point-of-sale systems for exactly this reason, and PCI DSS leans on it to shrink audit scope. A common mistake is treating segmentation as a one-time firewall rule; without regular review, permissive any-to-any rules creep back in and the boundaries quietly dissolve. Microsegmentation takes the idea further, applying policy at the individual workload level rather than the subnet.
Why does network segmentation matter for the CISSP exam?
It sits in Domain 4, Communication and Network Security. Candidates should connect segmentation to defense in depth, understand how VLANs and firewalls enforce zones, and recognize it as a core way to limit blast radius and support a zero trust architecture.