Network segmentation
Network segmentation divides a network into smaller logical or physical sections so their communications can be controlled separately.
The point is to limit what one part of the environment can reach. A compromised employee device should not automatically have a usable route to every server and management interface.
ASD distinguishes segmentation, the division into zones, from segregation, the rules that govern communication between them. That distinction matters: drawing separate boxes on a network diagram does not restrict traffic. The design needs enforcement at the relevant boundaries.
A useful review starts with a specific connection: its source, destination, service, and business reason. Check both required traffic and connections that should be denied. Include alternate routes and administrative access; a restrictive primary path is little help if another path bypasses it.
Reachability is only part of access
A permitted network connection does not grant application permissions. Conversely, an account with broad permissions may still be unable to reach a service from a particular network location. Network controls and identity controls answer different questions.
During containment, blocking a network path may need to happen alongside account and session actions. The identity-containment review covers those separate decisions. A blocked connection tells you about that route; it does not establish that the account has lost access everywhere.