How do we write segmentation rules without breaking things?

Base them on observed traffic, introduce them in stages and keep a way back. First record who actually talks to whom for a few weeks, including the jobs that run rarely: backups, payroll, month-end reports, the scanner that saves to a share. Draft allow rules from that, review them with the owner of each system, and decide which observed connections should not exist at all. Then set the firewall to log what the new rules would block, without blocking, and investigate each hit. Only after that, enforce, one segment at a time, with a rollback plan and someone on hand. Keep the rule set documented, with a reason and an owner for each rule. The NetSenX network map shows host-to-host communication on monitored segments, on every plan, which is the observed-traffic picture this method needs, and its lateral movement alerts afterwards show sessions that do not match the new normal.

← All 45 questions on Zero trust, identity and segmentationAll topics