[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.3.a
AP Cybersecurity · Securing Networks
Techniques for Segmenting a Network
All three buy the same thing: a compromised device reaches fewer other devices.
key ideaSegmentation buys one thing: a compromised device reaches fewer other devices.
Matching controls to threats
All three techniques answer the same threat — lateral movement — and they differ in where the boundary is drawn. Choosing between them is a question of what needs to be separated from what, not of which is strongest.
| Technique | How the boundary is made | Best for | Note |
|---|
| screened subnet (DMZ) | firewall zones and rules | public-facing services | sits between the internet and the internal network |
| subnetting | different IP addressing ranges | separating departments or functions | contains a breach to fewer exposed devices |
| VLANs | configured on switches | separating devices on shared physical infrastructure | logical separation without recabling |
The screened subnet is the one with a distinct purpose: it exists so that a service the internet must reach does not sit on the same segment as everything the internet must not.
what each one is for
- A screened subnet sits between public external networks and internal private ones.
- Subnetting contains a breach by reducing the number of exposed devices if one is compromised.
- VLANs logically separate devices that are physically connected to the same switch.
- All three limit lateral movement — that is the shared purpose.
Layering
These combine rather than compete. A typical design uses a DMZ at the edge, subnets by function inside, and VLANs where separate functions share a switch — three boundaries an adversary must cross rather than one.[Figure: Flat on the left, segmented on the right. In the flat network one compromised host reaches everything; segmenting means a breach stops at the first boundary it meets.]
Flat on the left, segmented on the right. In the flat network one compromised host reaches everything; segmenting means a breach stops at the first boundary it meets.SegmentationDividing a network into smaller, isolated segments so traffic in one cannot freely reach another.
Screened subnet / DMZA segment between public external networks and internal private ones, created with firewall zones and rules.
SubnetA division based on IP addressing. Devices in different subnets are routed, not simply switched, so filtering becomes possible.
VLANA logical network created on a switch, separating devices that share physical infrastructure.
Lateral movementThe threat all three techniques exist to constrain.
Worked analysis
EX 1
Where does the web server go?
An organization runs a public website and an internal payroll system. Where should the web server sit?
1
State the requirement
The internet must reach the web server; it must never reach payroll.
2
Reject the flat design
Both on one segment means a compromised web server sits beside payroll.
3
Choose the technique
A screened subnet — firewall zones placing the web server between external and internal.
4
Write the rules
Internet → DMZ permitted; DMZ → internal denied except specific, named flows.
5
State the payoff
Compromising the web server yields the DMZ, not the network.
EX 2
Same switch, different trust
A school has staff and student devices plugged into the same switches. Recabling is not possible. What technique applies?
1
Note the constraint
Shared physical infrastructure, and no budget to change it.
2
Choose the technique
VLANs — switches create them, separating devices logically.
3
Say what it achieves
Student traffic cannot reach staff devices even on the same switch.
4
Add the second layer
Give each VLAN its own subnet so a firewall can filter between them.
5
Note the limit
VLANs are a configuration, so a misconfigured trunk port can undo them. Verify, do not assume.
EX 3
Containing a breach
A finance workstation is compromised. In a flat network the adversary reaches 400 devices. How does subnetting change that?
1
Describe the flat case
Every device is reachable — one compromise, whole estate.
2
Apply subnetting
Finance sits in its own subnet of 25 devices.
3
State the immediate effect
The adversary reaches 25, not 400, without crossing a filtered boundary.
4
Note what makes it real
Traffic between subnets must be filtered. Routing alone separates addresses, not access.
5
State the principle
Segmentation does not prevent the compromise; it decides how much the compromise is worth.
Check yourself
What is a screened subnet, and where does it sit?
Show answer
A network segment created with firewall zones and rules that sits between public external networks like the internet and internal private networks. It is also called a DMZ.
What does subnetting achieve if a device is compromised?
Show answer
It contains the breach — the adversary reaches only the devices in that subnet, which reduces the number of exposed devices.
What do VLANs separate?
Show answer
Devices that are physically connected to the same central switches, separated logically rather than by recabling.
What single threat do all three techniques address?
Show answer
Lateral movement — an adversary who compromises one device using it to reach others. Segmentation decides how far that gets them.