Your network is flat. Here's what that costs you

Flat networks are the default because they're easy. Everything can talk to everything, nothing breaks, and the diagram fits on one page. The cost shows up on the day an attacker gets one foothold and finds there's nowhere they can't go.

What flat means in practice

A phishing email lands on a laptop in marketing. From that laptop, the attacker can reach the file servers, the domain controllers, the finance system, the backup console, and in too many cases the control network for the building or the plant. Each hop is a few minutes. Containment, when it comes, has to cover everything at once.

Segmentation isn't a project. It's a sequence of questions

• What are the five systems whose compromise would hurt most?
• What actually needs to talk to each of them, and on what ports?
• What's talking to them today that has no business doing so?

Answer those for one system, put the boundary in, watch what breaks, fix it, move to the next. That's how it gets done without a two-year programme that never finishes.

Where to start

Identity infrastructure and backups. If an attacker can't reach the domain controllers from a user workstation and can't reach the backup console from anywhere but a jump host, you've turned a flat network into one with two walls, and those two walls stop most ransomware from becoming a company-ending event.

The honest cost

Things will break. Some application nobody documented will stop working, and someone will be angry. That's the price of knowing what talks to what. Pay it on your schedule rather than on an attacker's.

If your diagram fits on one page and you're not sure that's a good thing, it probably isn't. I can help you find the first wall to build.

Explore: More on network security · Work with me