How Far Does It Spread? — TechKnowSurge

About this interactive

Segmentation is the division of something into separate parts. The lesson starts with one company share that every employee can open: when Juan's account is compromised, the attacker reads every team's files. Split the data into a Management share, an Operations share and a Sales share, give each team only its own, and the same compromise reaches the Sales share. The idea applies to every part of the attack surface: separate networks for separate systems, separate servers and databases, a separate access key for each application, badge zones in a building, and separation of duties between people, so no single account can both create a vendor and pay it. Two things decide how far a compromise spreads: where the boundaries are, and what is still allowed across them. A segment with a leftover firewall rule or a group membership nobody removed is open along that path. Segmentation and access control work together; neither contains anything alone.

What you'll learn

Predict what a compromised account, device, key or badge can reach in a segmented design and in an unsegmented one
Apply segmentation across the attack surfaces the lesson names: data and file shares, networks, access keys, databases, physical areas and people (separation of duties)
Explain why segmentation contains a compromise only when access control follows it, so a leftover group membership or firewall rule reopens a segment

Aligned to

CompTIA Security+

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

4.6 Given a scenario, implement and maintain identity and access management.

Key terms

Network Segmentation: The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.
Separation of Duties: Separation of Duties is a security control principle requiring that critical or sensitive tasks be divided among multiple individuals to prevent fraud, collusion, and unauthorized actions by any single person.
Least Privilege: A security principle that grants users and systems only the minimum access rights needed to perform their functions.
Attack Surface: The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Access Control: A security mechanism that restricts access to resources based on policies, roles, or identity.

Topics

Network Segmentation Separation Of Duties Least Privilege Access Control Interactive Predict

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →