TechKnowSurge

VideoSecurityFree

Segmentation

Segmentation is the security principle of dividing systems, data, and access into separate sections to reduce exposure and limit the impact of a compromise. Applying it correctly ensures users and systems can only reach what they genuinely need.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Segmentation is a foundational security principle focused on dividing systems, data, networks, and access into isolated sections rather than maintaining a single shared environment. When resources are open to everyone, a compromised account or device becomes a gateway to the entire organization. Separating those resources by team, function, or sensitivity level ensures that any breach is contained to a much smaller scope, dramatically reducing overall risk. This principle applies across every attack surface an organization manages. Data and file storage can be partitioned so that each department accesses only its own share. Networks can be divided to prevent lateral movement between segments. Servers and databases can be dedicated to specific functions, and access keys or credentials can be scoped accordingly. Even human roles are subject to segmentation through separation of duties, which prevents any single individual from having unchecked control over a critical process. Segmentation works in close alignment with least privilege — together, they ensure that both people and systems operate with exactly the access they need and nothing beyond it. Whether implemented physically, digitally, or procedurally, segmentation is a practical and scalable control that strengthens an organization's overall security posture.

What you'll learn

Explain the principle of segmentation as a security control and describe how it can be applied across physical, digital, and organizational attack surfaces to limit unauthorized access.

What's covered

Segmentation Principle

What Is Segmentation
- Division into separate parts
- Applies to any attack surface
Why Segmentation Matters
- Supports least privilege
- Limits compromised account damage
Types of Segmentation
- Physical separation
- Digital separation
- Separation of duties
- Segmenting outside entities
Segmentation Examples
- Separate servers per team
- Separate files and databases
- Separate networks and access keys
- Management, Operations, Sales shares

Key terms

Segmentation: The process of dividing a large message or data stream into smaller pieces called segments before transmission across a network, allowing multiple devices to share the medium and enabling parallel transfer. TCP performs segmentation at Layer 4 and numbers the segments so the receiver can reassemble them in the correct order.
Attack Surface: The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Least Privilege: A security principle that grants users and systems only the minimum access rights needed to perform their functions.
Network Segmentation: The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.
Access Control: A security mechanism that restricts access to resources based on policies, roles, or identity.

Topics

Network Segmentation Access Control Defense In Depth Zero Trust Cybersecurity Attack Surface

Transcript

Another principle that we should be using is segmentation: separating things out.

Let's look at a little scenario here. Let's say Juan is part of the sales team. This company right here has a share folder for everybody in the company, no matter what team that they're on, so Juan really has access to all of the files and folders for the whole company. This already violates least privilege — Juan has access to too much, because now if his account were ever to be compromised, then they could get access to all of the company's files and folders.

In this scenario, we're going to want to do some sort of segmentation or separation. We're going to separate this data out into individual folders. So now we've got, for the management team, their own share file. We've got, for the operations, their own share. And we've got, for sales, their own share. So now Juan has access to all of the files and folders that Juan needs, without getting access to files and folders that Juan doesn't need access to.

What segmentation is

Segmentation is the division into separate parts or sections. We can really do this for any of our attack surfaces. We can physically separate things. We can digitally separate things. We can separate out humans, like separation of duties. We've also got outside entities that maybe we want to segment somehow.

Here's just an example of how we segmented out management, operations and sales. Perhaps we have their own servers for each one. Perhaps we have their own data and files for each one. Perhaps their own databases, their access keys, maybe their separate networks. Whatever it is that we need to segment out, we practice this segmentation.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →