A flat network can let one compromised device become a path toward many other systems. Network segmentation places systems and workloads into controlled zones and limits the communication allowed between them, reducing unnecessary access and helping contain incidents.
Segmentation begins with assets and trust requirements
The bank inventories systems, workloads, users, devices and data flows, then groups them according to business function, sensitivity, criticality and administrative needs. Customer-facing services, employee devices, payment environments, security tools and recovery systems may require different zones and protection levels.
A useful design follows actual dependencies rather than only office locations or old network diagrams. Unknown connections and undocumented legacy protocols can undermine a boundary because the bank cannot control a flow it does not know exists.
Only necessary communication crosses a boundary
Firewalls, gateways, access controls and other enforcement points permit defined traffic between segments and block what is not required. Rules identify the source, destination, service, purpose and owner instead of allowing broad ranges simply because systems sit inside the same organization.
Default-deny treatment can reduce exposure where it is operationally appropriate, but a restrictive rule set must still support critical processing and recovery. Changes are tested and approved so a security improvement does not create an unrecognized service interruption.
Microsegmentation can narrow access between workloads
Traditional segmentation often separates larger network zones. Microsegmentation can apply more granular policy to individual workloads or application groups, including within a data center or cloud environment where many systems share underlying infrastructure.
Identity, device posture and application context can complement network addresses when deciding whether to allow a connection. This aligns with zero-trust principles, but segmentation is one security layer—not proof that a network has fully implemented zero trust.
Monitoring shows whether the boundaries work
Logs and network telemetry show permitted and denied connections, unusual east-west movement, rule changes and attempts to reach sensitive zones. Alerts are linked to asset and identity context so responders can distinguish a configuration error from reconnaissance or lateral movement.
Exceptions have named owners, reasons and expiration dates. A temporary broad connection that remains open after a migration can become an invisible permanent route around the intended design.
Testing includes failure, recovery and third parties
Teams test representative paths, administrative access, failover, backups and recovery operations rather than checking only that a firewall rule exists. Vendor connections and remote support receive the same scrutiny because trusted external access can become a route into several internal environments.
Segmentation can limit an incident's blast radius, but it cannot compensate for every weakness. Strong identity, secure configuration, patching, endpoint protection, monitoring and tested recovery remain necessary when an attacker has valid credentials or compromises a system within an allowed zone.
Read the primary material
Banking Explained prioritizes regulators, official publications and first-party announcements.