Secure Network Architecture and Segmentation

Introduction

A secure network is not simply a collection of firewalls, switches, and authentication servers. It is an intentionally designed system in which users, devices, applications, and data are placed into controlled communication environments. The architecture determines what may communicate, under which conditions, through which control points, and with what evidence for later investigation.

Historically, organisations protected internal systems by constructing a strong perimeter around a trusted internal network. This model remains useful for some environments, but it is insufficient where employees work remotely, applications run in cloud platforms, contractors use unmanaged devices, and attackers can exploit stolen credentials. Modern architecture therefore combines perimeter controls with internal segmentation, identity-based controls, continuous monitoring, and explicit verification.

This chapter explains zones, VLANs, demilitarised zones (DMZs), microsegmentation, proxies, gateways, bastion hosts, and network access control (NAC). It also compares perimeter, defence-in-depth, and Zero Trust architectures and applies them to a practical business scenario.

Learning objectives

By the end of this chapter, you should be able to:

• explain why network segmentation reduces cyber risk;
• distinguish physical, logical, zone-based, and microsegmentation;
• design a topology containing internal zones, VLANs, DMZs, proxies, gateways, bastion hosts, and NAC;
• compare perimeter, layered, and Zero Trust architectures;
• apply least privilege and default-deny principles to network design;
• identify operational, technical, ethical, and governance limitations; and
• evaluate a proposed architecture against business requirements.

1. Architectural foundations

1.1 Trust boundaries and attack surfaces

A trust boundary is a point at which the security assumptions, identity requirements, or policy applied to traffic change. Examples include the boundary between the public internet and an organisation, between a user VLAN and a server VLAN, and between a production network and an administration network.

An attack surface is the set of reachable interfaces, services, identities, devices, applications, and pathways that an attacker might exploit. Segmentation does not remove every vulnerability; instead, it limits reachability and can prevent compromise of one component from becoming compromise of the entire organisation.

A sound design begins by identifying:

1. business services and their dependencies;
2. information classifications and regulatory requirements;
3. users, devices, applications, and external partners;
4. required communication flows; and
5. unacceptable communication flows.

The principle of least privilege should apply to network paths as well as file permissions. A payroll workstation may need HTTPS access to a payroll application, but it normally does not need direct database access or unrestricted access to engineering systems.

1.2 Security zones

A security zone is a group of assets subject to a common security policy. Zones may be based on function, sensitivity, administrative responsibility, or exposure. Typical zones include:

• Internet or untrusted zone: external networks outside organisational control.
• Public-services DMZ: internet-facing web, DNS, mail-relay, or reverse-proxy services.
• User zone: ordinary employee endpoints.
• Server zone: application and infrastructure servers.
• Restricted data zone: highly sensitive databases or regulated records.
• Management zone: administrative interfaces, monitoring, backup, and configuration systems.
• Guest or contractor zone: limited-access devices and users.
• Industrial or operational technology zone: systems requiring special availability and safety controls.

A zone is not automatically secure merely because it has a name. Its security depends on the enforcement point, the rules, the identity evidence, monitoring, and the effectiveness of the controls surrounding it.

1.3 VLANs and routing boundaries

A virtual local area network (VLAN) logically separates Layer 2 broadcast domains on shared switching infrastructure. For example, VLAN 10 might contain staff endpoints, VLAN 20 voice devices, and VLAN 30 guest devices. VLAN membership can be assigned by switch port, device identity, authentication result, or policy.

VLANs are useful for organisation and containment, but a VLAN is not a complete security boundary. Traffic between VLANs must be routed, and the router or Layer 3 switch must enforce an access-control policy. Poorly configured trunk ports, native VLANs, switch management interfaces, or inter-VLAN routing can undermine the intended separation.

A secure design commonly uses:

• separate VLANs for different trust classes;
• explicit inter-VLAN firewall or ACL rules;
• disabled unused ports;
• secure management protocols such as SSH rather than Telnet;
• authenticated network-device administration; and
• monitoring of configuration changes and unusual east–west traffic.

1.4 DMZ design

A demilitarised zone is a controlled network between less-trusted and more-trusted environments. A public web server may be placed in a DMZ so that internet traffic does not directly reach internal application or database networks.

A DMZ is not a dumping ground for every externally accessible system. The organisation should define each service, its required flows, and the consequences of compromise. A common three-zone pattern is:

Internet → reverse proxy or web firewall → web DMZ → application zone → database zone.

Each arrow represents a policy decision, not an automatic permission. For example, the web tier may accept HTTPS from the reverse proxy and initiate only the specific application protocol toward the application tier. The database should accept connections only from approved application hosts, not from the internet or ordinary user VLANs.

A dual-firewall DMZ can use separate devices or separate security contexts, while a single firewall may implement multiple interfaces and zones. Separation of devices may reduce common-mode failure, but it increases cost and operational complexity. The important property is explicit policy enforcement and independent validation, not the number of appliances alone.

1.5 Proxies and gateways

A proxy intermediates communication between a client and a destination. A forward proxy acts on behalf of internal clients, whereas a reverse proxy acts on behalf of servers. Proxies can hide internal addresses, apply URL or content policy, authenticate users, terminate TLS, cache content, and record transactions.

A gateway is a broader term for a system that connects networks or protocols and may enforce policy. Examples include an email security gateway, API gateway, secure web gateway, VPN gateway, and identity-aware application gateway.

Proxies and gateways provide valuable control points, but they are not automatically trustworthy. TLS inspection may create privacy and key-management issues; a compromised proxy can become a high-value target; and logging can expose sensitive information. Organisations should document which traffic is inspected, who may access the logs, how long logs are retained, and which categories are excluded for legal or ethical reasons.

1.6 Bastion hosts and jump servers

A bastion host is a hardened system designed to withstand attack and provide a controlled access path to a protected environment. A jump server is a common administrative bastion: administrators authenticate to it, and from there connect to servers in a management or production zone.

Effective bastion-host practice includes:

• minimal installed services;
• rapid patching and vulnerability management;
• phishing-resistant multi-factor authentication where feasible;
• individual accounts rather than shared credentials;
• time-limited and approved administrative access;
• session recording or command auditing, subject to law and policy;
• restricted outbound connectivity; and
• administrative access only through approved management networks.

A bastion host should not become a single unmonitored tunnel. Its purpose is to centralise and strengthen administration, not to bypass segmentation.

2. Segmentation models

2.1 Perimeter architecture

The perimeter model places a firewall or gateway between the internet and a relatively trusted internal network. It is simple to understand and can be economical for a small organisation with fixed premises and limited remote access.

Its weakness is the implicit assumption that internal systems are trustworthy. Once an attacker obtains a foothold through phishing, an exposed service, or a stolen VPN credential, broad internal reachability can support discovery, credential theft, ransomware propagation, and data exfiltration.

2.2 Defence in depth and layered architecture

Layered architecture applies multiple, partially independent controls: secure configuration, endpoint protection, firewalls, VLANs, identity controls, encryption, monitoring, backups, and incident response. If one control fails, another may still prevent or detect the attack.

Layering is stronger than a single perimeter, but it can become ineffective if all controls share the same assumptions, credentials, management plane, or untested rules. Controls must be reviewed as a system. For example, a firewall rule that permits broad remote administration may negate the benefits of a carefully separated server network.

2.3 Zero Trust architecture

Zero Trust is an architectural approach rather than a single product. Its central ideas are:

• no implicit trust based solely on network location;
• explicit verification of identity, device condition, application context, and request;
• least-privilege access;
• continuous or repeated evaluation as risk changes; and
• collection of telemetry for policy and detection.

Zero Trust does not mean eliminating every network boundary or treating every packet identically. Zones, firewalls, VLANs, and DMZs remain useful enforcement mechanisms. The difference is that network location alone is not sufficient evidence of trust.

For example, an employee on an internal VLAN may be denied access to a finance application if the device is unmanaged or the user lacks the required role. A managed device outside the office may receive controlled access through an identity-aware gateway after successful authentication and device verification.

2.4 Microsegmentation

Microsegmentation applies fine-grained policy to workloads, applications, users, or processes rather than relying only on broad network segments. It may be implemented through host firewalls, software-defined networking, cloud security groups, service meshes, or endpoint agents.

Microsegmentation is particularly valuable for east–west traffic inside data centres and cloud environments. Policy can express that an application service may call a database on a specific port, while peer applications and compromised user endpoints cannot.

Its challenges include discovering legitimate dependencies, managing policy at scale, handling legacy systems, and avoiding excessive complexity. A policy that blocks an essential dependency can cause an outage; a policy that permits broad ranges for convenience provides little containment. Successful implementation usually begins with visibility and a small number of high-value applications, followed by testing and gradual refinement.

3. A reference secure topology

The following conceptual topology illustrates how controls can work together.

Figure: A conceptual layered topology in which gateways and policy enforcement separate public, application, data, user, guest, and management environments.

The diagram is illustrative rather than prescriptive. In a real design, traffic flows should be recorded in a matrix. A simplified policy matrix might be:

The default posture should be deny unless a documented business requirement justifies a permitted flow. Rules should be narrow in source, destination, protocol, port, identity, time, and device condition. Rules must also have owners, review dates, logging requirements, and a process for removal when no longer needed.

4. Network access control and identity

NAC evaluates a device or connection before granting network access. It may use 802.1X authentication, certificates, directory identities, device posture, switch information, and endpoint-management data. Possible outcomes include full access, a restricted remediation network, a guest network, or denial.

NAC is most effective when it is integrated with identity and endpoint systems. A device can be authenticated yet still be unsafe if it is unpatched, compromised, or running unauthorised software. Posture checks should therefore be proportionate and reliable. False positives can interrupt essential work, while false negatives create unjustified confidence.

NAC should support exceptions for printers, medical devices, industrial controllers, and other equipment that cannot perform normal authentication. Such exceptions require compensating controls, documented ownership, restricted placement, and monitoring.

Identity-aware policy should distinguish authentication from authorisation. Authentication answers “Who or what is this?” Authorisation answers “What may it do?” A valid password may establish identity, but it does not by itself justify access to a restricted database.

5. Designing a secure architecture

A practical design method is as follows.

Step 1: establish requirements and risk

Identify critical services, maximum tolerable disruption, data sensitivity, legal obligations, users, partners, and operational constraints. Safety-critical and availability-sensitive systems may require different controls from ordinary office services.

Step 2: map assets and dependencies

Use inventories, configuration data, flow logs, application owners, and interviews. Record dependencies such as DNS, identity services, time synchronisation, certificate validation, backup, and monitoring. Unknown dependencies are a major cause of segmentation failure.

Step 3: define zones and trust boundaries

Group assets according to function and risk, not merely physical location. Separate public services, users, applications, databases, administration, backups, and guests where their policies differ.

Step 4: specify allowed flows

For every proposed flow, state the source, destination, protocol, port, identity, justification, and logging requirement. Prefer application-mediated access over direct access to sensitive stores.

Step 5: select enforcement mechanisms

Use firewalls and ACLs for zone boundaries, VLANs for local separation, proxies for mediated access, bastions for administration, NAC for admission, and microsegmentation for workload-level control. Use encryption for confidentiality and integrity, but do not treat encryption as a substitute for authorisation.

Step 6: implement safely

Begin with observation and staged enforcement. Test critical flows, failure modes, redundancy, logging, rollback, and emergency access. Changes should follow change-management procedures and be validated by service owners.

Step 7: monitor and improve

Collect firewall decisions, authentication events, configuration changes, endpoint signals, DNS activity, and relevant application logs. Correlate events in a security information and event management system where appropriate. Review rules for redundancy, shadowing, excessive scope, and lack of ownership.

6. Worked application: a regional healthcare provider

The following is a fictional illustrative case.

Background

A regional healthcare provider operates clinics, a central hospital, an online appointment service, diagnostic devices, a finance system, and remote administrative access. It previously used one internal network behind a perimeter firewall. A phishing incident compromised an employee account, and an attacker moved laterally toward file servers.

Problem

The organisation needed to reduce lateral movement without disrupting clinical services. Some diagnostic devices could not support modern endpoint agents or 802.1X. The online appointment service required internet access, while patient records required strong confidentiality and availability.

Analysis

The assessment identified four high-risk weaknesses: broad internal reachability, shared administrative credentials, direct workstation access to servers, and insufficient visibility of device-to-device traffic. It also identified a safety requirement: clinical devices could not simply be disconnected when a posture check failed.

Approach and solution

The provider created separate user, clinical-device, guest, public-service, application, patient-data, backup, and management zones. Public web traffic terminated at a reverse proxy in the DMZ. The application tier could access the patient database only through named service identities and approved ports. User devices accessed applications through controlled services rather than directly accessing database networks.

NAC placed managed staff devices into role-based VLANs. Guest devices received internet-only access. Unsupported diagnostic devices were placed in restricted clinical VLANs with tightly limited destinations, compensating monitoring, and documented exceptions. Administrators used a hardened bastion host with MFA and individual accounts. Microsegmentation policies restricted communication between workloads in the application tier.

The design also separated backup administration from ordinary domain administration and required immutable or otherwise protected backup copies. Logs from network controls, identity systems, endpoints, and applications were centralised for investigation.

Outcome

In this illustrative scenario, the provider reduced the number of permitted internal paths, made administrative activity attributable to individuals, and improved detection of abnormal lateral movement. The architecture did not guarantee prevention of compromise, and it introduced policy-management work, testing requirements, and possible clinical-service disruption if rules were poorly designed.

Learning points

1. Segmentation must reflect business dependencies and safety constraints.
2. Unsupported devices require compensating controls, not informal exceptions.
3. Administrative pathways deserve stronger controls than ordinary user traffic.
4. Zero Trust principles can coexist with VLANs, DMZs, and firewalls.
5. Security outcomes depend on governance, monitoring, and maintenance as well as topology.

7. Limitations, governance, and contemporary practice

Segmentation can increase cost, complexity, and troubleshooting effort. Incorrect rules can interrupt emergency services, manufacturing processes, or legitimate research. Excessive inspection can reduce performance and create privacy concerns. Centralised gateways and bastions can become high-impact failure points and attractive targets.

Governance should define ownership of zones, rule approval, review frequency, emergency changes, logging access, retention, and evidence required for audits. Rules should be mapped to business requirements and, where relevant, obligations concerning personal data, healthcare information, financial records, or critical infrastructure. Monitoring must be proportionate: employees should be informed about significant monitoring, access to records should be restricted, and retention should not exceed legitimate need.

Cloud and hybrid environments require policy consistency across on-premises firewalls, cloud security groups, identity providers, service meshes, and endpoint controls. Infrastructure as code can make policy review and deployment repeatable, but automated deployment can also distribute an error rapidly. Peer review, testing, version control, and rollback remain essential.

Artificial intelligence may assist with traffic baselining, anomaly detection, dependency discovery, and rule recommendations. It should support—not replace—engineering judgement. Models can produce false positives, inherit biased training data, expose sensitive telemetry, or recommend rules that are difficult to explain. High-impact decisions should remain reviewable and accountable.

Best practices include:

• document business flows before enforcing restrictions;
• use default deny at meaningful boundaries;
• separate administration from ordinary user access;
• prefer identity and device context over location alone;
• minimise direct access to sensitive data stores;
• protect and monitor control-plane interfaces;
• test segmentation using authorised vulnerability assessment and attack-path analysis;
• design redundancy for critical enforcement points; and
• review policies continuously as applications and threats change.

Chapter Summary

Secure network architecture places systems into purposeful zones and controls communication between them. VLANs provide logical Layer 2 separation, while routing controls, firewalls, ACLs, proxies, gateways, and microsegmentation enforce policy. DMZs reduce the consequences of exposing public services, and bastion hosts provide controlled administrative access. NAC links admission decisions to identity and device condition.

A perimeter architecture is simple but relies heavily on internal trust. Layered defence combines independent controls, while Zero Trust removes implicit trust based only on network location and requires explicit, least-privilege, context-aware decisions. These approaches are complementary: a Zero Trust programme can still use zones, DMZs, VLANs, and firewalls.

Effective design begins with business requirements, asset and dependency mapping, explicit flow matrices, staged implementation, monitoring, and governance. Segmentation reduces attack paths but introduces complexity, operational risk, privacy considerations, and maintenance obligations. Its success therefore depends as much on policy ownership and continuous validation as on technical devices.

Key Terms

Trust boundary: A point where security assumptions or policy change.

Attack surface: The reachable interfaces, services, identities, and pathways that may be exploited.

Security zone: A group of assets governed by a common security policy.

VLAN: A logical Layer 2 broadcast domain implemented on switching infrastructure.

Inter-VLAN routing: Routing traffic between VLANs, where security policy can be enforced.

DMZ: A controlled network for services that require limited external exposure.

East–west traffic: Traffic moving between internal systems or workloads.

North–south traffic: Traffic moving between internal environments and external networks.

Proxy: An intermediary that makes or receives network requests on behalf of another party.

Gateway: A system that connects networks or protocols and may enforce policy.

Bastion host: A hardened system designed to provide controlled access to protected resources.

Jump server: An administrative host used to reach other systems through a controlled pathway.

NAC: Network access control that evaluates identity, device, or posture before admission.

Microsegmentation: Fine-grained policy applied to workloads, applications, users, or processes.

Least privilege: Granting only the access necessary for an authorised task.

Default deny: Blocking access unless a specific rule permits it.

Zero Trust: An approach requiring explicit, contextual verification rather than implicit network trust.

Defence in depth: The use of multiple complementary security controls.

Lateral movement: An attacker’s movement between internal systems after initial compromise.

Policy matrix: A structured record of permitted and denied communication flows.

Review Questions

Short Answer Questions

1. Why is a VLAN alone not a complete security boundary?
2. What is the main purpose of a DMZ?
3. Distinguish a forward proxy from a reverse proxy.
4. What role does a bastion host perform?
5. State two principles associated with Zero Trust.

Long Answer Questions

1. Explain how a layered architecture can reduce the impact of a compromised endpoint.
2. Compare perimeter, layered, and Zero Trust architectures, including strengths and limitations.
3. Describe a secure topology for an organisation hosting a public web application and a sensitive database.
4. Explain the benefits and challenges of microsegmentation in a cloud or data-centre environment.
5. Discuss how NAC, identity, and device posture can work together to enforce least privilege.

Analytical / Application Questions

1. A university has staff, students, guests, research servers, and an online payment service. Propose zones, VLANs, DMZ controls, and at least five permitted or denied flows. Justify each decision.
2. A hospital cannot install agents on older medical devices. Analyse the risks and design compensating controls that preserve availability and safety.
3. An organisation wants to replace all internal firewalls with a Zero Trust product. Evaluate this proposal and explain which existing controls should be retained, changed, or integrated.

Multiple Choice Questions with Answers

Question 1

Which statement best describes a security zone?

A. A group of assets governed by a common security policy

B. A cable connecting two switches

C. A public IP address assigned to a router

D. A backup copy stored offline

Correct Answer: A. A group of assets governed by a common security policy

Question 2

Why is a VLAN alone insufficient as a security boundary?

A. VLANs cannot separate broadcast domains

B. Traffic can be routed between VLANs unless policy controls it

C. VLANs work only on wireless networks

D. VLANs automatically permit internet access

Correct Answer: B. Traffic can be routed between VLANs unless policy controls it

Question 3

What is the primary purpose of placing a public web service in a DMZ?

A. To give it unrestricted access to internal databases

B. To eliminate the need for authentication

C. To limit the consequences of compromise of an externally exposed service

D. To prevent all monitoring of the service

Correct Answer: C. To limit the consequences of compromise of an externally exposed service

Question 4

Which system commonly provides controlled administrative access to protected servers?

A. Guest VLAN

B. Bastion or jump host

C. Public DNS resolver

D. Open wireless access point

Correct Answer: B. Bastion or jump host

Question 5

Which principle is central to Zero Trust?

A. Trust every device inside the corporate network

B. Permit access based only on IP address

C. Verify explicitly and apply least privilege

D. Remove all network segmentation

Correct Answer: C. Verify explicitly and apply least privilege

Question 6

What does microsegmentation primarily provide?

A. Fine-grained controls between workloads or applications

B. A replacement for all identity controls

C. Automatic physical isolation of every cable

D. Unrestricted east–west connectivity

Correct Answer: A. Fine-grained controls between workloads or applications

Question 7

A guest VLAN should normally have which access pattern?

A. Direct access to database servers

B. Internet access with restricted access to internal zones

C. Full access to management interfaces

D. Administrative access to all user devices

Correct Answer: B. Internet access with restricted access to internal zones

Question 8

Which access-control posture best supports least privilege at a zone boundary?

A. Allow all traffic and investigate later

B. Permit traffic only when a documented rule justifies it

C. Allow all traffic from internal IP addresses

D. Disable logging to improve performance

Correct Answer: B. Permit traffic only when a documented rule justifies it

Question 9

What does NAC evaluate before or during network admission?

A. Only the colour of a network cable

B. Identity, device, or security posture information

C. The organisation’s annual budget

D. The physical size of a database

Correct Answer: B. Identity, device, or security posture information

Question 10

Which statement about Zero Trust and traditional segmentation is most accurate?

A. They cannot be used together

B. Zero Trust makes firewalls and DMZs irrelevant

C. Zero Trust can use segmentation while requiring context beyond network location

D. Traditional segmentation always provides identity-based authorisation

Correct Answer: C. Zero Trust can use segmentation while requiring context beyond network location