How do we limit what a compromised laptop can reach?

Assume one laptop will be compromised and decide in advance how little it should be able to touch. Ordinary laptops rarely need to talk to each other, so block laptop-to-laptop traffic with the client firewall or switch settings; let them reach servers only on the ports their applications use; keep backups, management interfaces and the domain controller's admin paths out of their reach; and make sure the user is not a local administrator, so that malware cannot easily switch off protection or harvest other accounts' passwords. On the VPN, give each group access only to what it needs. Then check the result with real traffic, because a rule set on paper often has gaps. NetSenX shows which hosts talk to which on monitored segments and flags new host-to-host sessions that do not match a laptop's normal as lateral movement, along with scanning and beaconing, on every plan, so you see where a compromised laptop could still reach.

← All 45 questions on Zero trust, identity and segmentationAll topics