Secure network architecture: segmentation and zero trust

Sub-domain 4.1 asks you to apply secure design principles to network architectures. The principles themselves, least privilege, defence in depth, secure defaults, fail securely, separation of duties, keep it simple, zero trust and trust but verify, were introduced in CISSP-112. This lesson applies them to networks: how to divide a network into zones, how to control what crosses between them, how the traditional perimeter model has given way to zero trust, and how newer service models such as SD-WAN and SASE change the picture. The goal of all of these designs is the same: to make sure that when, not if, an attacker gains a foothold somewhere, they cannot move freely to the assets that matter.

From flat networks to zones

In a flat network every device can reach every other device. Flat networks are simple to build and manage, which is why so many small and older networks are flat, but they give an intruder who compromises one laptop a direct path to every server, controller and backup system. The great majority of serious ransomware incidents involve lateral movement of exactly this kind: an initial foothold through phishing or an exposed service, followed by credential theft and movement across an unsegmented network to domain controllers and backups.

Segmentation divides the network into zones, groups of systems with similar trust levels, functions and protection needs, and controls traffic between them. Typical zones include an internet-facing demilitarized zone, user workstations, guest and visitor access, servers by sensitivity, management networks for administrators and device interfaces, payment card environments, operational technology and backup networks. The boundaries between zones are enforced by firewalls, router access control lists, switch VLANs with filtering between them, or software policies in virtualized and cloud environments. The rule set at each boundary should allow only the flows the business needs, a default-deny posture that applies least privilege to traffic.

The DMZ and screened subnets

A demilitarized zone, DMZ, or screened subnet, holds systems that must accept connections from untrusted networks, such as public web servers, mail relays, reverse proxies and remote access gateways. It sits between the internet and the internal network so that a compromised public server does not give the attacker direct internal access. Classic designs use either a three-legged firewall, one device with interfaces for the internet, the DMZ and the internal network, or two firewalls in series, often from different vendors, so that a single product flaw does not expose everything. The two-firewall design adds cost and complexity but gives stronger defence in depth.

Rules for a DMZ follow a simple pattern. The internet may reach specific DMZ services on specific ports. DMZ systems may reach a few named internal services, for example a web server reaching an application server on one port, and nothing else. Internal users may reach DMZ systems for administration only from management hosts. DMZ systems should not initiate connections to the internet except where needed, such as mail relays sending mail, because unrestricted outbound access is how compromised servers fetch tools and leak data. Bastion hosts, hardened systems exposed to attack, and jump servers, hardened hosts administrators must pass through to reach sensitive zones, are related ideas.

VLANs and their limits

Virtual local area networks, VLANs, defined in IEEE 802.1Q, divide one physical switch infrastructure into several logical layer 2 networks. Frames carry a 12-bit VLAN tag, allowing up to 4,094 usable VLANs. VLANs are cheap and flexible and are the usual building block of campus segmentation, but on their own they only separate broadcast domains. Traffic between VLANs must pass through a router or layer 3 switch, and it is the access control list or firewall at that point that actually enforces policy. A layer 3 switch routing freely between VLANs without filtering provides almost no security.

VLANs can also be attacked. In switch spoofing, an attacker's device negotiates a trunk link using the dynamic trunking protocol and then receives traffic for every VLAN. In double tagging, an attacker on the native VLAN sends frames with two tags; the first switch strips the outer tag and forwards the frame with the inner tag into another VLAN. Defences are straightforward configuration hygiene: disable automatic trunk negotiation on access ports, set access ports explicitly, use a dedicated unused VLAN as the native VLAN on trunks, shut down unused ports and place them in an isolated VLAN. Private VLANs go further, isolating hosts in the same subnet from each other, which suits hotel networks, guest Wi-Fi and some server farms.

Micro-segmentation

Micro-segmentation applies policy at the level of individual workloads rather than whole subnets. In virtualized data centres and clouds, a distributed firewall in the hypervisor or a host-based agent enforces rules for each virtual machine or container, so that two servers in the same subnet can still be prevented from talking to each other. Policies are often written in terms of labels or tags, such as application, environment and role, rather than IP addresses, which lets rules follow workloads as they move or scale. Micro-segmentation is a powerful defence against lateral movement, but it requires an accurate map of application dependencies. Projects usually begin in a monitoring mode that records actual flows before enforcing rules, because blocking an undocumented dependency can break a business service.

Zero trust architecture

The traditional castle-and-moat model trusts anything inside the perimeter. That assumption has collapsed: users work from home and on the road, applications run in several clouds, partners connect directly, and attackers routinely get inside through phishing. Zero trust replaces location-based trust with explicit verification of every access request, based on identity, device posture and context, and grants the least access needed for the shortest time. NIST Special Publication 800-207, Zero Trust Architecture (2020), is the standard reference. It describes a policy decision point, made up of a policy engine that decides and a policy administrator that sets up or tears down the session, and policy enforcement points that sit in front of resources and allow or block traffic. Inputs to the decision include identity and authentication strength, device health from endpoint management, threat intelligence, activity logs and data classification.

SP 800-207 lists tenets that are useful in exam questions. All data sources and computing services are resources. All communication is secured regardless of network location. Access is granted per session. Access is determined by dynamic policy. The enterprise monitors the integrity and security posture of all assets. Authentication and authorization are dynamic and strictly enforced before access. The enterprise collects as much information as possible about the current state of assets, network and communications and uses it to improve its security posture. The publication also describes deployment approaches: enhanced identity governance, micro-segmentation and software-defined perimeters, and in practice most organizations combine them.

In Canada, the Canadian Centre for Cyber Security has published guidance on zero trust approaches for organizations and on the Government of Canada's own journey, and federal departments follow Treasury Board direction on enterprise security architecture. Canadian guidance broadly aligns with NIST SP 800-207, so the model above applies. Check the Cyber Centre's current publications for the latest status (checked October 2026).

Zero trust is a strategy and an architecture, not a product. Vendors label almost everything "zero trust", but no single purchase achieves it. Adoption is a multi-year journey that typically starts with strong identity, including phishing-resistant multifactor authentication, an inventory of devices and their health, an understanding of data and its classification, and a map of important application flows. Organizations then protect high-value resources first, moving them behind enforcement points that check identity and device for every session, and gradually reduce reliance on network location. A sensible first step on the exam is almost always to identify the protect surface: the critical data, applications, assets and services the organization must protect.

SD-WAN and SASE

Wide area networks traditionally connected branches to headquarters over private circuits such as MPLS, backhauling internet traffic through central firewalls. Software-defined WAN, SD-WAN, uses several transport links, such as broadband, MPLS and cellular, and a central controller to steer traffic over the best path according to policy, with encrypted tunnels between sites. SD-WAN cuts costs and improves performance for cloud applications, but sending branch internet traffic directly out of each site would bypass central inspection unless security moves with it.

Secure access service edge, SASE, a term introduced by the analyst firm Gartner in 2019, combines SD-WAN with cloud-delivered security services: secure web gateway, cloud access security broker, firewall as a service and zero trust network access, delivered from points of presence near users. The security service edge, SSE, is the security part alone. Zero trust network access, ZTNA, replaces broad VPN access with per-application connections brokered after identity and device checks, so a user can reach the payroll application without being placed on the network where the payroll servers live. When evaluating these services, managers should ask about the provider's points of presence and resulting latency, where traffic is decrypted and logged, data residency and the provider's own security assurance, such as SOC 2 Type II reports or certification against ISO/IEC 27001.

Architecture for resilience

Secure design also means availability. Redundant links and devices, diverse carrier paths, high-availability firewall pairs, and out-of-band management networks that remain reachable when the production network fails all belong in the architecture. An out-of-band management network, separated from user traffic and reachable only through hardened jump hosts with strong authentication, also protects the management plane, the interfaces that control routers, switches and firewalls. Attackers who reach the management plane can reconfigure the whole network, so management interfaces should never be exposed to user zones or the internet.

Thinking like a manager

Questions in this area often contrast a technology answer with a design answer. If an organization has a flat network and suffers lateral movement, segmentation is the design fix, and the first step is to understand assets and flows. If remote access gives users the whole network, zero trust network access or tighter VPN policies apply least privilege. If a question asks what zero trust means, the answer is never "trust nothing and block everything"; it is to verify explicitly, grant least privilege and assume breach. Remember that every boundary needs an owner, a documented rule set and periodic review, because rules accumulate and segmentation decays without governance.