Ruslan Rakhmetov, Security Vision
Traditional methods of testing software and its components, such as unit and integration testing, do an excellent job of verifying expected behavior. However, developers and those attempting to compromise their software also pay attention to situations in which a program receives data that its algorithms are not designed to handle. This is the phenomenon we will discuss in this article, covering:
The traditional model and the principles of Zero Trust
How microsegmentation relates to incident response
How to implement this principle using best practices (a step-by-step guide)
Digitalization, migration to cloud environments, the rise of remote work, and increasingly complex supply chains have effectively dissolved the traditional network perimeter. The earlier concept of granting unconditional trust to the internal network by default (Implicit Trust) has become a vulnerability, whereas zero trust architecture (Zero Trust Architecture, ZTA) requires continuous, dynamic authentication and strict authorization for every request, regardless of its origin.
The Traditional “Castle-and-Moat” Model vs. Zero Trust
For decades, the traditional network security model was built around what the industry calls a “castle-and-moat” architecture: perimeter firewalls, intrusion prevention systems (IPS), and VPN gateways protected a trusted internal network from the external internet environment. This model had—and still has—a flaw: the presumption of innocence for everything inside the perimeter. In other words, any user, device, piece of software code, or compromised contractor account that successfully crossed the outer barrier gained trusted access to a wide range of internal resources.
This led to the publication of SP 800-207 by the U.S. National Institute of Standards and Technology (NIST), which rejects this implicit trust. The standard defines Zero Trust not as an individual product or technology, but as a set of principles and solutions aimed at minimizing uncertainty. It requires treating the network as compromised by default, meaning that network location—being in the office or connected through a corporate VPN—is no longer sufficient grounds for granting trust. Access must follow the principle of least privilege: an entity receives access only to the resources strictly necessary for its current task, and only for the duration of that task.
The Zero Trust Maturity Model (ZTMM), version 2.0, developed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), structures implementation of this architecture around five foundational pillars that must develop in parallel:
1) Identity
2) Devices
3) Networks
4) Applications (Workloads)
5) Data
Where Does Microsegmentation Fit In?
Within the Networks pillar, microsegmentation is an essential requirement for an organization’s transition from the Traditional maturity level to the Advanced and Optimal levels. Without micro-level segmentation, the network remains flat, allowing any threat to spread unhindered.
Imagine an airport beyond the security checkpoint. The old assumption was that once passengers had passed through the metal detector at the airport entrance (the external firewall), they were completely safe and could board any aircraft (a flat network). Zero Trust changes the rules: now your boarding pass, passport, and face are scanned before you enter each terminal, before you visit a café in the departure lounge, and right at the jet bridge before you board a specific flight.
The CISA ZTMM identifies the following mechanisms for achieving this:
1) Strict authentication of all assets, multifactor authentication (MFA), and real-time risk assessment.
2) Continuous monitoring of endpoint health, including checks on updates, disk encryption status, and agent activity.
3) Moving away from routing based on trust in network topology. Implementing microsegmentation, encrypting all internal traffic, and isolating workloads. We will explore this area in greater detail below.
4) Integrating security into the development lifecycle, continuous authorization between services, and protection against API exploitation.
5) Information classification, file-level access management, encryption of data at rest and in transit, and data loss prevention.
Microsegmentation shifts the security focus from the network level (Layers 2/3 of the OSI model) to the application and process level (Layers 4–7). Instead of relying on static IP addresses and port topology, microsegmentation introduces software-defined isolation policies for each individual virtual machine, container, or even a specific process within an operating system.
How Microsegmentation Works
Imagine a hotel where macrosegmentation means giving you a key that opens the door to the entire third floor, on the assumption that you are an honest person and will enter only your own room. Microsegmentation works differently: it is an electronic key card programmed to open only the door to your particular room and the turnstile at the gym. You physically cannot open the room next door, even if it is only a meter away.
Policies in this model are tied not to ephemeral IP addresses that may change, but to the cryptographically verified identities of entities. This means that even if attackers obtain valid credentials and an IP address within a segment, they cannot reach systems that have not been explicitly authorized for the compromised identity. Let us break this down into four characteristics:
· Granularity
Macrosegmentation operates at the level of subnets, VLANs, and physical sites, whereas microsegmentation operates at the level of individual workloads, containers, endpoints, and processes.
· Policy Basis
The static IP addresses, port ranges, and network topology used at the macro level give way to identity, metadata, business context, and roles in microsegmentation.
· What Is Accessible
Open by default within a zone (Implicit Trust), or closed by default (Default Deny / Explicit Trust).
· Scalability
Macrosegmentation requires access control lists (ACLs) to be reconfigured when assets migrate, whereas microsegmentation policies dynamically follow workloads as they scale.
Why Response Speed Matters
The value of microsegmentation cannot be understood without examining how modern cybercriminals operate after successfully breaching the perimeter. The initial attack vector—for example, a phishing email, exploitation of a zero-day vulnerability in a VPN gateway, or credentials purchased from initial access brokers—usually gives attackers control over an ordinary user’s device or a low-priority server, neither of which typically contains truly valuable data.
To achieve their objective—stealing confidential information, reaching domain controllers, or deploying ransomware against critical databases—attackers must move horizontally from system to system. In cybersecurity, this process is known as lateral movement.
To move through the network, hackers exploit the same paths used by legitimate traffic: they use stolen credentials, attack legacy protocols (such as NTLM and SMB), and abuse standard remote administration tools (RDP, WMI, and PowerShell) to avoid attracting the attention of conventional antivirus software. Automation and the addition of artificial intelligence to hackers’ arsenals have accelerated this spread to an unprecedented pace.
This behavior and movement resemble an infection spreading through the bloodstream. A dangerous pathogen enters the human body, and if the immune system does not isolate the infected tissue early on, the virus uses the circulatory system (legitimate network protocols) to spread to all vital organs. Microsegmentation is a kind of strict quarantine in which an infected “house” (a network node) is cordoned off by police and medical personnel (for example, SOAR) within the first few seconds, preventing the disease from reaching the city streets.
Speed is therefore decisive, and response tools should be selected so that their actions can be readily automated and defined through protocols and processes. Better still, AI can be brought into this area as well: it can help analysts compile reports, collect data, trace an intruder’s path, and identify the node that can be isolated most quickly using microsegmentation principles. This keeps the “home” of corporate data protected 24/7.
A Step-by-Step Deployment Strategy
Implementing microsegmentation and moving to a full-fledged Zero Trust architecture involves a profound transformation of IT infrastructure that cannot be achieved simply by purchasing an off-the-shelf product. Enabling strict blocking rules across the network all at once will almost certainly disrupt critical business processes, deny service to legitimate applications, and prevent employees from doing their jobs.
CISA and industry experts recommend an iterative approach known as “Crawl, Walk, Run,” integrating elements gradually.
This approach resembles switching to a strict diet. A person cannot give up all carbohydrates and sweets in a single day: the body will not cope with the stress, and the diet will fail. Implementing Zero Trust works in much the same way. First, you simply record everything you eat during the day (flow inventory). Then you eliminate obvious junk, such as soda (restricting clearly vulnerable SMB/RDP protocols). Only after adapting do you move on to strict calorie and macronutrient tracking (implementing rigorous microsegmentation at every level). In technical terms, these stages can be described as follows:
a) Discovery and Inventory (Discovery & Assessment)
At this stage, the organization deploys analysis tools, such as sensors, to create an accurate application dependency map and map all assets and data flows. You cannot protect what you cannot see. The goal is to understand normal behavior: which servers access databases, which ports are used, and whether any unjustified communication paths exist—for example, surveillance cameras pinging a finance server. Core tools include AM/ITAM/CMDB systems, while organizations with mature processes can also benefit from Data Discovery and UBA/EBA/UEBA.
b) Policy Development (Define Objectives)
Using the collected telemetry, security specialists work with business application owners to develop segmentation rules. Policies should express business logic—who should have access to what—rather than simply manipulate IP addresses. The focus is on high-value assets and protecting critical databases. Systems such as HCC/SPC can help at this stage, as can the processes themselves, managed by an RPA engine—for example, the process designer built into the Security Vision Platform.
c) Pilot Deployment and Monitoring Mode (Pilot / Monitor Mode)
Microsegmentation policies are deployed in audit mode, also known as shadow or monitoring mode. The policy enforcement point (PEP) begins inspecting traffic, but instead of blocking unauthorized packets, it only generates alerts in the monitoring system. This allows engineers to identify false positives, where a legitimate but infrequent process—for example, a quarterly database audit—is incorrectly classified as a violation. SIEM systems serve as a single pane of glass for monitoring and can be enhanced through enrichment from analytics services and TIP threat intelligence.
d) Active Policy Enforcement (Enforce)
After thorough calibration of the rules in monitoring mode, the system switches to active blocking. Unauthorized network packets are now actually dropped. Deployment usually starts with test groups of workloads, then extends through rings of development environments, and moves to critical production environments only after successful validation. Blocking is configured on firewalls and NGFWs, with EDR/XDR and SOAR systems also involved.
e) Continuous Optimization (Iterate & Integrate)
Zero Trust architecture has no endpoint. Policies are reviewed regularly and adapted to new microservice deployments, integration with new vendors, and changes in the threat landscape. Performance metrics include the percentage of workloads covered by enforced rules and the time required to contain an incident.
As a result, the organization gradually moves from the Traditional level of the CISA ZTMM, where trust is based on gaining access to the local network, to the Optimal level, where dynamic policies are adjusted in real time based on continuous risk assessment.
Implementing microsegmentation within the Zero Trust paradigm is a complex, multilayered process. Yet modern attack statistics demonstrate that, in a world where compromise of the initial perimeter is only a matter of time, granular limitation of the blast radius remains the only effective way to prevent full-scale corporate disasters.
 (2).jpg)
.jpg)
