Network Security Architecture: Zero Trust, Defense in Depth, Segmentation

A flat network is one where every device can reach every other device: laptops, servers, printers, and cameras all sit in one big open space. Flat networks are easy to build and easy to attack. The attacker's problem is only getting in once; after that, nothing stands between the first compromised machine and everything else.

Consider a concrete scenario. An employee at a small firm opens a phishing attachment and malware lands on her laptop. On a flat network, that laptop can reach the finance server, the HR database, the backup system, and the building's security cameras directly, because nothing in the network's design says otherwise. The attacker scans, finds an unpatched file server, and within hours holds the company's data. The initial phish was the entry; the flat network did the rest. This spreading from an initial foothold to other systems is called lateral movement, and limiting it is the central goal of network security architecture.

Network segmentation answers this by dividing the network into smaller zones and controlling the traffic allowed between them. If workstations, servers, and cameras live in separate segments, the compromised laptop can no longer reach the finance server directly: its traffic must cross a control point, where policy can deny it and monitoring can see the attempt. Segmentation does not prevent the first compromise; it contains the blast radius so one infected laptop stays one infected laptop. The rest of this lesson covers the tools that create segments, from firewall zones to VLANs to micro-segmentation, and the design philosophies, Defense in Depth and Zero Trust, that decide how strictly the boundaries are enforced.

The classic way to segment with a firewall is to define zones: groups of networks that share a trust level, with rules governing what may pass between them. The simplest design has two zones: the trusted internal network, containing your users and systems, and the untrusted external world, meaning the internet. The default posture is that inside may initiate connections out, while unsolicited traffic from outside is denied.

That two-zone design breaks as soon as you run a public service. Your web server must accept connections from strangers on the internet, but placing it inside the trusted zone means every stranger's connection terminates next to your internal systems. The answer is a third zone: the DMZ, or demilitarized zone, a buffer segment between the untrusted internet and the trusted internal network where public-facing servers live.

The logic to remember: if an attacker compromises the web server, they are standing in the DMZ, not inside your network. The firewall still blocks them from reaching internal systems, so the breach is contained in the buffer zone. Exam stems that mention hosting a public-facing server or a segment between the internet and the internal network are describing the DMZ.

A VLAN (virtual local area network) segments a network logically rather than physically. A managed switch can be configured so that some of its ports belong to one VLAN and other ports to another; devices in different VLANs cannot talk directly at Layer 2 even though they are plugged into the same physical switch. Each VLAN is its own broadcast domain, and traffic between VLANs must pass through a router or firewall, which is exactly where you place the rules.

The value is separation without new hardware. A company can put finance on one VLAN, general staff on another, guest Wi-Fi on a third, and its IP cameras and printers on a fourth, all running over the same switches and cables. The guest VLAN can be allowed to reach only the internet; the camera VLAN can be allowed to reach only its recording server. Without VLANs, achieving that separation would require physically separate switches and cabling for each group.

Two cautions keep the concept honest. First, a VLAN is a Layer 2 construct: it separates broadcast domains, and its security value comes from forcing inter-VLAN traffic through a control point that enforces policy. If the router simply passes everything between VLANs unfiltered, you have organized the network but not secured it. Second, VLANs are configuration, so a misconfigured switch can leak traffic between segments. For the exam, the recognition line is: VLANs provide logical segmentation at Layer 2, letting one physical switch behave as several isolated networks.

Micro-segmentation takes the segmentation idea to its finest granularity: policy per individual workload, meaning each server, virtual machine, or application gets its own rules about exactly which other systems may talk to it, on which ports. Where zones separate the network into a few large regions and VLANs into groups of devices, micro-segmentation draws the boundary around each machine.

The problem it solves is traffic inside a segment. In a traditional design, two servers in the same data center segment can usually reach each other freely, so an attacker who compromises one server can move laterally to its neighbors without ever crossing a firewall. With micro-segmentation, the web server is allowed to reach the application server on one specific port, the application server may reach the database on another, and every other combination is denied, including web server directly to database. The compromised web server now has almost nowhere to go. Micro-segmentation is typically enforced in software, through host-based firewalls or the virtualization and cloud platform, rather than by a physical appliance, which is what makes per-workload policy practical at scale.

Keep the ladder in mind: zones, then VLANs, then micro-segmentation, each step smaller and stricter. Micro-segmentation also reappears later in this lesson as a key enabler of Zero Trust.

Defense in Depth is the principle of layering multiple, independent security controls so that no single control's failure exposes the asset. Any one control can fail: a firewall can be misconfigured, a user can be phished, an antivirus signature can miss new malware. Defense in Depth accepts that and arranges controls in series, so an attacker must defeat layer after layer, and each layer they hit is another chance to stop them, slow them, or at least detect them.

A typical layered stack, from the outside in: policies and security awareness training shape user behavior; physical security controls who can touch the equipment; the perimeter firewall filters what enters the network; segmentation limits movement inside it; endpoint protection defends each device; authentication and least-privilege access control who can use each application; and encryption protects the data itself. The layers are deliberately of different kinds, mixing technical, physical, and administrative controls, because unrelated controls do not share the same weaknesses.

Play the earlier phishing scenario against this stack. Awareness training reduces the chance the employee clicks; if she does, endpoint protection may catch the malware; if it does not, segmentation stops the laptop from reaching the finance server; if the attacker still reaches the database, encryption makes the stolen files unreadable, and monitoring has been generating alerts at every step. No layer was perfect; the depth was the defense. On the exam, stems that say no single point of failure, layered security, or multiple overlapping controls are describing Defense in Depth.

The traditional security architecture is often called castle-and-moat: build a strong perimeter around the network, inspect everything at the gate, and treat everything inside as trusted. The firewall is the moat; once a user or device is inside, whether physically in the office or connected by VPN, it moves largely unchallenged. Trust, in this model, is a function of network location: inside means trusted, outside means untrusted.

Three developments broke the model. First, the perimeter dissolved. Applications moved to the cloud, employees work from homes and coffee shops, and partners and contractors need access from everywhere, so inside stopped being a meaningful place: the resources are no longer inside, and neither are the users. Second, insiders and stolen credentials defeat a location-based defense by definition. A malicious employee is already past the moat, and an attacker who phishes a valid password and connects through the VPN is indistinguishable from a legitimate insider. Third, lateral movement: because the interior is trusted, one compromised endpoint gives an attacker a soft, open network to explore, which is exactly the flat-network failure from the start of this lesson.

The lesson to carry forward is precise: the perimeter model's fatal assumption is implicit trust based on network location. Every weakness above is that assumption failing in a different way. Zero Trust, next, is the architecture built by deleting that assumption, and exam questions frequently hinge on spotting it: any answer option that grants access because the request comes from the internal network is the castle-and-moat mistake.

Zero Trust is a security architecture built on one core principle: never trust, always verify. No user, device, or connection is trusted implicitly because of where it sits on the network. Being inside the corporate network, on the VPN, or in the data center earns nothing; every request for access must be verified before it is granted, every time.

The supporting ideas flow from that principle. Verify explicitly: authenticate and authorize every request based on evidence such as user identity, device health, and location, not on network position; strong authentication, including multi-factor authentication, is fundamental here. Least privilege: grant each verified identity access only to the specific resources it needs, and nothing more, so even a fully verified user cannot wander. Assume breach: design as if an attacker is already inside, which means containing lateral movement, monitoring continuously, and never treating the interior as safe. Micro-segmentation is a key enabler: by drawing enforcement boundaries around individual workloads, it creates the many small checkpoints at which every request can be verified, replacing the single big checkpoint at the perimeter.

Two clarifications prevent common exam mistakes. Zero Trust is an architecture and a set of principles, not a single product you can buy; vendors sell components, but Zero Trust is how you design. And Zero Trust does not mean no one gets access; it means access is granted per request, based on verification, to the minimum resource needed. Trust is never assumed, it is established, and it is re-established continuously rather than granted once at login and kept forever.

The exam's favorite question in this sub-domain is a contrast: given a description of behavior, identify which model it belongs to. This table is the study object.

Note what Zero Trust does not discard. Firewalls, zones, and DMZs still exist and still do useful work; Zero Trust removes the implicit trust behind them, not the controls themselves. Defense in Depth is fully compatible: Zero Trust is arguably Defense in Depth applied to trust decisions, adding verification as a layer at every boundary instead of only at the outer wall.

Run the phishing scenario one final time under Zero Trust. The attacker controls the employee's laptop, but reaching the finance system requires a verified request: the system checks identity and device health, challenges with multi-factor authentication, and the attacker fails. Even with a stolen password and a position inside the network, location buys nothing, least privilege caps what the account could reach anyway, and micro-segmentation blocks the direct path between laptop and database. Compromise of one endpoint no longer implies compromise of the organization, which is the whole point of the architecture.