- › The perimeter did not fail, it stopped being where your assets are, and most network programs still spend as if it were.
- › Segmentation is the highest-return control available, because it decides how far a single compromised device can reach.
- › Egress filtering is the one most organizations skip, and it is what turns a foothold into an exfiltration.
- › You cannot defend an inventory you do not have, and the devices missing from yours are the cameras, controllers, and appliances nobody classified as computers.
- › Detection on the network is about what a device talks to and how often, because encryption took the content away years ago.
Somebody once described a network diagram to me as a drawing of what the company intended. The network itself is a drawing of what happened.
That gap is where this whole discipline lives. Your diagram shows three zones and a firewall. The real network has a camera recorder that reaches the file server, a vendor’s remote support tool with a standing tunnel, a printer with an outside address, a decommissioned test box that still routes, and a machine learning cluster a data science team stood up in a cloud account nobody put on the register.
None of that was a decision. It accumulated.
The Perimeter Did Not Fail
There is a version of this conversation that treats the firewall as obsolete, and it is wrong in a way that costs people money.
The perimeter still works exactly as designed. What changed is where your assets went. When everything valuable sat in one building, a boundary around that building was a complete control. Now your data is in cloud tenants, your staff work from wherever, your suppliers have portals inward, and your workloads talk to services you do not run. The boundary is still solid. It just does not enclose very much anymore.
Think of it as a fence around a field you no longer farm. The fence is fine. Go look at where the crop is.
What follows is the order I would work in, based on what assessments keep turning up rather than on what a product category chart suggests.
1. Build the Inventory You Do Not Have
Every control below depends on knowing what is on the network, and almost nobody does.
The gap is never the servers. It is the devices nobody filed as computers: the camera recorder, the badge controller, the building automation panel, the conference room system, the uninterruptible power supply with a management card, the label printer in the warehouse. Each one is a computer with an address, running firmware somebody shipped and nobody patches.
Run active discovery rather than reading the asset register, because the register describes what procurement bought and the network describes what is plugged in. Expect to find between 10% and 30% more devices than you have records for. That delta is the finding, and it is where the next incident starts.
For each device the questions are short: what is it, who owns it, what does it need to reach, and what patches it.
2. Segment, Because It Decides the Blast Radius
Segmentation is the highest-return control in this article and the one most often deferred, because it requires knowing the answer to that last question above.
Consider the arithmetic. A flat network means one compromised device equals reachability to everything, so the attacker’s cost of moving from a parking garage camera to your finance server is close to zero. Segment it properly and that same compromise buys them a camera network, and every step outward costs time, generates traffic, and creates a chance for you to notice.
That is the entire proposition. Segmentation does not prevent compromise. It converts a total loss into a bounded one and buys you the detection window that makes everything else possible.
Where to draw the lines first
Start with the segments where the argument is easiest and the return is highest.
Physical security devices go on their own segment. Cameras, recorders, badge controllers, and intercoms have a small, knowable set of things they need to talk to, and no business reason to reach a file server. This is the network side of the vendor problem we wrote about in physical security vendors as network vendors.
Operational technology goes next, and goes hardest. If you run programmable logic controllers, the joint federal advisory this month on AI-written tooling against Siemens S7 devices is the current argument, and its own first mitigation is blocking internet access to those controllers.
Then guest and untrusted wireless, then anything a third party administers, then your administrative workstations, which should reach management interfaces that ordinary user machines cannot.
Do not let perfect scope stall it
The common failure is trying to segment everything at once, discovering the dependency mapping is enormous, and shipping nothing. One segment done this quarter beats a complete design that stays in a document.
3. Control What Leaves
Almost every organization filters inbound traffic carefully and lets outbound go wherever it likes.
Turn that around and look at what an attacker needs. Inbound gets them in. Outbound is how they command the foothold, stage tooling, and take the data. A compromise with no egress path is a compromise that sits there.
Practical version: default-deny outbound from server and device segments, with an allowlist of what each one legitimately needs. Your camera network needs the recorder, the time source, and possibly the vendor’s cloud, and that is the list. Your controllers need almost nothing.
User segments are harder because people browse, so start with the servers and devices where the allowlist is short and the exception queue will be manageable.
Watch specifically for the things that ride allowed paths. Command and control over DNS, or through a cloud service everybody permits, is the current default rather than an exotic technique. The Cavern framework we covered this month runs over DNS and Google Apps Script for exactly that reason.
4. Instrument for Behaviour, Not Content
Encryption took the packet contents away and it is not coming back. Inspecting traffic you can no longer read is a spend with a declining return.
What is still visible is the shape: which device talked to what, how often, in which direction, at what time, and how much moved. That is enough for most of the questions that matter.
The detections worth building are unglamorous. A device talking to something it has never talked to before. A workstation making a connection at 3am on a schedule. Steady small outbound volumes from a machine that has no reason to send anything. A management interface reached from a segment that should not reach it.
None of that requires reading the traffic. All of it requires knowing what normal looks like for that device, which is why the inventory came first.
5. Treat Remote Access as the Perimeter It Has Become
Your virtual private network concentrator, your gateway appliance, and your remote desktop broker are the boundary now, for real. That is why they are the products getting the maximum-severity ratings.
Two of the past two weeks’ worth of briefings make the point. A NetScaler flaw scored 9.3 for bypassing authentication on gateway and AAA configurations. The CNIL’s 42 million euro fine against Free Mobile and Free named inadequate virtual private network authentication as a specific failure. These devices are load-bearing and they get patched on the slow schedule because taking them down means taking remote work down.
Give them the fast schedule instead. Put phishing-resistant authentication in front of them, per what to fix first in identity and access management.
What This Costs to Skip
The business case is easiest to make in blast radius rather than in probability, because you will not win an argument about whether you get compromised.
A flat network turns a $200 camera into access to your entire file estate. An unfiltered egress path turns a contained foothold into a notification obligation and a regulator conversation. A missing inventory means the incident response firm you pay by the hour spends the first two days building the map you did not have, at their rate.
Segmentation and egress control are mostly configuration on equipment you already own. The cost is engineering time and the political work of telling teams their thing now has to declare what it talks to. That is the hard part, and it is cheaper than the alternative by an order of magnitude.
For the architectural frame around all of this, zero trust as a phased implementation covers where segmentation sits in a larger program, and the 2025 guide to operational technology security covers the industrial half in depth.
Start Here Tomorrow
Pick your camera network, or your badge controllers, or whichever set of devices you are most confident should never talk to a file server.
Find out whether they can. Not whether the diagram says they should not, whether they can, right now, from that segment to that server.
The answer takes an afternoon and it will tell you what kind of network you actually have rather than the one on the wall.
Want to know what your network looks like rather than what the diagram says? Contact Grab The Axe for a network and segmentation assessment, or start with our free Human Attack Surface Score.
Operating on the philosophy that 'you can't build a secure system if you don't know how to break it,' Chris leads our engineering division. A top 1% National Cyber League competitor, he hardens our digital infrastructure against the very exploits he has mastered.
View Author Page →
