How it works
Segmentation separates systems so a guest device, student device, web server, database, and administrator workstation do not all have the same reach.
Ask what traffic is necessary. Then deny or isolate traffic that is not needed for the workflow.
Common error
A flat network is convenient, but it increases blast radius when one device is compromised.
Worked example
A guest device can connect directly to an internal database. Design a narrower trust boundary.
Evidence
Guest network -> database: currently allowed
Application server -> database: required
Guest network -> public internet: requiredSeparate guest devices from sensitive systems and allow database access only from the approved application path and maintenance roles. Verify the guest denial and the legitimate application flow. Segmentation limits unnecessary reach but does not replace application authentication.
Exercises
3.1.1
Why does a flat network increase the consequences of a compromised guest device?
Show solution
Unnecessary direct paths can let the device reach additional systems. Segmentation with restrictive verified rules reduces that reach and limits some forms of lateral movement.
3.1.2
Give one allowed and one denied cross-zone flow for a web application and its database.
Show solution
Allow the approved application server to the database on its required service. Deny direct guest-to-database connections. Document any separate approved management path.