Zero trust architecture and network segmentation

Why the old model fails

Traditional networks were built like a castle: a strong firewall at the edge and broad trust inside. Today users work from anywhere, applications live in the cloud, and attackers who get one foothold (often through phishing) move sideways across a flat internal network. Location on the network is no longer a good reason to trust anyone.

Zero trust principles

• Verify explicitly: check identity, device health and context for every request.
• Least privilege: give access only to the specific applications needed, only for as long as needed.
• Assume breach: design so that one compromised device or account does limited damage, and monitor continuously.

NIST Special Publication 800-207 describes zero trust architecture in detail and is a good vendor-neutral reference.

Segmentation: macro and micro

• Macro-segmentation splits the network into large zones (users, servers, guests, IoT, OT) using VLANs, VRFs and firewalls between them.
• Micro-segmentation applies policy per workload or per device, often in the hypervisor, host firewall or switch, so even two servers in the same subnet can only talk if allowed.
• Start with the zones that matter most: guests, IoT and cameras, payment systems, and management networks.

Network access control and ZTNA

• 802.1X checks a device before its switch port or Wi-Fi connection opens. The supplicant (device) talks to the authenticator (switch or AP), which asks the authentication server (RADIUS). The result can place the device in the right VLAN or apply a policy.
• ZTNA (zero trust network access) replaces broad remote-access VPNs: users reach individual applications through a broker after verification, and the rest of the network stays invisible.

A practical roadmap

1. Inventory users, devices, applications and data flows.
2. Strengthen identity: single sign-on and MFA everywhere.
3. Check device health before granting access.
4. Segment the network, starting with high-risk zones.
5. Move remote access from VPN to ZTNA, application by application.
6. Log and monitor everything, and refine policies over time.

Real-world example: a clinic network

A fictional group of three medical clinics shared one flat network for receptionists, doctors, patient Wi-Fi and medical devices such as blood pressure monitors. An audit warned that a compromised reception PC could reach the patient records server directly. The IT provider introduced zero trust step by step. Staff now sign in with multi-factor authentication, and laptops must pass a health check before they get access. Medical devices were moved to their own segment that can only talk to the records server on the ports they need. Patient Wi-Fi was isolated completely. When a reception PC later opened a malicious attachment, the infection stayed on that one machine and the records server was untouched.