The VLAN post near the start of this trail ended with segmentation as a security win: split the network into zones, force traffic between zones through a firewall checkpoint. True — and for twenty years, that was the state of the art. This post is about the limitation that model hit, and the idea that grew past it. It starts with two compass directions.
North-south vs east-west
Network people describe traffic by direction: north-south traffic enters or leaves the environment (user to server, server to internet); east-west traffic moves laterally, between systems inside it (app server to database, server to server). Traditional segmentation — VLANs plus perimeter firewalls — inspects north-south traffic thoroughly. East-west traffic, between machines in the same zone? It flows freely. Nobody's checking. And in modern data centres, east-west traffic is the overwhelming majority of all traffic.
Why attackers love the east-west lanes
Read any serious incident report and the pattern repeats: initial compromise of one modest machine, then lateral movement — hopping system to system, harvesting credentials (remember pass-the-ticket from the Kerberos post?), climbing toward the crown jewels. The zone model actively helps them: once inside the "server VLAN," an attacker can typically reach every server in it, because same-zone traffic was never a checkpoint's business. Big flat zones are big flat hunting grounds. The breach didn't happen where the attacker entered; it happened everywhere they could walk to afterwards.
The idea: shrink the zone to one
Microsegmentation takes segmentation to its logical limit: policy enforced around each workload individually — every server, VM, or container carries its own rules, typically enforced by the hypervisor or host itself rather than a distant network appliance. And the rules are written in intent, not addresses: "web tier may talk to app tier on port 443; app tier may talk to its database on 1433; nothing else, in any direction." Default deny — the firewall post's four sacred words — applied between every pair of machines, including neighbours in the same subnet. The hotel analogy: VLANs gave each floor a keycard door; microsegmentation puts a lock on every room. A burglar on floor three no longer gets thirty rooms for free.
The honest practitioner's caveat: the hard part isn't enforcement technology — it's knowing what legitimately talks to what. Decades-old environments contain traffic flows nobody documented and nobody dares break. Real microsegmentation projects therefore begin with weeks of pure observation — mapping actual flows — before a single deny rule ships, and mature tools build the proposed policy from that map. Segment blind and you don't stop attackers; you cause outages and get the project cancelled.
Zoom out and notice the shape of the idea: trust based on being inside a zone, replaced by explicit per-workload verification. That's the third time this trail has met the same move — zero trust did it to users, conditional access to sign-ins, microsegmentation to servers. Different layers; one direction of travel.