# How do we write segmentation rules without breaking things?

Base them on observed traffic, introduce them in stages and keep a way back. First record who actually talks to whom for a few weeks, including the jobs that run rarely: backups, payroll, month-end reports, the scanner that saves to a share. Draft allow rules from that, review them with the owner of each system, and decide which observed connections should not exist at all. Then set the firewall to log what the new rules would block, without blocking, and investigate each hit. Only after that, enforce, one segment at a time, with a rollback plan and someone on hand. Keep the rule set documented, with a reason and an owner for each rule. The NetSenX network map shows host-to-host communication on monitored segments, on every plan, which is the observed-traffic picture this method needs, and its lateral movement alerts afterwards show sessions that do not match the new normal.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/how-to-build-allow-rules-from-real-traffic

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Is a DMZ still useful for a small company?](https://netsenx.com/en/faq/is-a-dmz-still-useful)
- [Can we segment a small office network without buying new hardware?](https://netsenx.com/en/faq/how-to-segment-a-small-office-without-new-hardware)
- [How do we protect our domain controller or directory server?](https://netsenx.com/en/faq/how-to-protect-the-domain-controller)
- [Does zero trust mean monitoring employees?](https://netsenx.com/en/faq/does-zero-trust-mean-monitoring-employees)
- [Is zero trust realistic for a small business?](https://netsenx.com/en/faq/is-zero-trust-realistic-for-a-small-business)