Authentication & Access · Study deck

Microsegmentation and East-West Control

Picture a temperature sensor that should send readings to one building service.

Shield Shelly is your guide for this deck.

zero-trustnetwork-segmentationmicrosegmentation

After studying this chapter

Learning objectives

You will be able to:

Explain: This overview gives the practitioner a way to stop trusting location: maintain inventory accountability, watch for policy drift, test east-west denials, and look under the hood for any bypass path.
Explain: Without separate admission for IoT, management, guest, and operator devices, and without client isolation, wireless peers can still discover and reach each other even when the wired policy looks tight.
Explain: Designing this way directly limits east-west movement, the lateral hops an attacker uses to spread, which is the same as limiting the blast radius of any single compromise.

Major section

Design From the Path, Not the Subnet

It shares the site with cameras, door controls, and staff systems.

Placing it inside the building network does not explain why it should reach only its own service.
Here telemetry is the sensor reading and device status crossing the proposed trust boundary.
The useful path should remain open.

Two-panel zero-trust comparison: Sensor, Camera and Ctrl share a flat segment on the left; on the right, Subject and Enforce separate approved paths to Data, Device and Cmd resources. The contrast shows why location alone grants too much reachability.

Major section

Design From the Path, Not the Subnet (continued)

Every neighbouring path should fail closed and leave a clear reason without relying on the sensor's location as proof of trust.

This small path test does not prove the whole site is secure.
The deeper sections show how resource lists, enforcement placement, rule drift, bypass checks, and repeated denial tests limit movement after one device is compromised.
The practical consequence is a change in the unit of design.

Major section

Design From the Path, Not the Subnet (continued)

The zero trust segmentation question is not "which network is the sensor on?" but "which subject may perform which action on which resource, through which enforcement point, and what proves every other path stays closed?".

Network location can still be a useful signal, but it must not become the reason a device is trusted.
The guiding principle, set out in the NIST zero trust architecture, is to never grant access based on location alone and to verify each request against a policy.
A VLAN separates broadcast domains but does not by itself authorize access to each resource.

Major section

Design From the Path, Not the Subnet (continued)

Designing this way directly limits east-west movement, the lateral hops an attacker uses to spread, which is the same as limiting the blast radius of any single compromise.

This overview gives the practitioner a way to stop trusting location: maintain inventory accountability, watch for policy drift, test east-west denials, and look under the hood for any bypass path.
The next sections use that resource-path model to define policy fields and choose enforcement points.
Allowed path, not trusted zoneA segment is not a container of mutual trust.
The unit is a specific subject, action, and resource under conditions.

Major section

Write and Enforce Allowed Paths

The work is to turn "least access" into reviewable records and to put enforcement where a path can actually be denied.

IoT gives you several layers, and a strong design combines them rather than trusting one.
Monitoring records the decisions across those boundaries.
Weak isolation lets wireless peers still discover each other.

Zero trust segmentation enforcement placement showing wireless edge, switch or firewall boundary, local gateway, service API, data store, and monitoring evidence.

Major section

Write and Enforce Allowed Paths (continued)

The comparison prepares the ledger by showing why one broad firewall rule cannot enforce every path with the same precision.

Final check even if a network rule is wrong.
Skipping it trusts the network to be perfect.
Each rule can now name its subject, resource, action, conditions, enforcement point, and evidence.

Two-panel zero-trust comparison: Sensor, Camera and Ctrl share a flat segment on the left; on the right, Subject and Enforce separate approved paths to Data, Device and Cmd resources. The contrast shows why location alone grants too much reachability.

Major section

Keep Lateral Movement Denied

The deeper layer explains the mechanics that make or break IoT segmentation: lateral movement, who actually gets identified at the enforcement point, and how policy decays.

Microsegmentation enforces per-resource policy so one compromised sensor cannot hop to its neighbour.
Wireless lateral paths must be tested directly, not assumed to be covered by segment labels.

East-west controls in zero trust segmentation showing peer device paths denied, approved gateway paths allowed, management path isolated, and monitoring observing denied attempts.

Major section

Keep Lateral Movement Denied (continued)

Gateways are essential for constrained endpoints, but mediation must preserve the originating identity rather than forwarding everything under one shared credential.

Devices cannot move laterally to neighbours, permitted traffic crosses the gateway, management remains isolated, and monitoring observes both grants and denials.
Per-path record with allow and deny tests.
Lateral hops between devices are blocked.

Major section

Keep Lateral Movement Denied (continued)

Mediation Must Not Erase AccountabilityRead Figure: East-west controls in zero trust segmentation showing peer from the crossed-out peer links toward the one mediated route.

Devices cannot talk laterally, approved traffic passes through the gateway, management remains on a separate controlled path, and monitoring observes both grants and denials.
Wireless Lateral MovementWireless groups need explicit treatment, because a shared wireless network can become an accidental trusted zone.
Constrained devices reach resources with accountability.

Major section

Keep Lateral Movement Denied (continued)

A segment becomes a trusted container with open peers.

Without separate admission for IoT, management, guest, and operator devices, and without client isolation, wireless peers can still discover and reach each other even when the wired policy looks tight.
Wireless peers cannot freely reach each other.
Weak admission lets peers discover and connect.

Major section

Keep Lateral Movement Denied (continued)

IoT deployments fail at east-west because devices on the same local network can reach peers directly.

Drift and the Limits of Observe ModeSegmentation decays as new devices, support paths, firmware behaviors, temporary exceptions, and emergency workarounds are added without review.
Reopened or new paths are noticed.
New-destination alerts and repeated denied-path tests.

Major section

Key Takeaway

Segmentation limits the blast radius of a compromise, but only if it is built from resources and allowed paths rather than from trusted network zones.

A VLAN with a friendly name is not zero trust.

Deck summary

Key takeaways

It shares the site with cameras, door controls, and staff systems.

Every neighbouring path should fail closed and leave a clear reason without relying on the sensor's location as proof of trust.
The zero trust segmentation question is not "which network is the sensor on?" but "which subject may perform which action on which resource, through which enforcement point, and what proves every other path stays closed?".
Designing this way directly limits east-west movement, the lateral hops an attacker uses to spread, which is the same as limiting the blast radius of any single compromise.

Retrieval practice

Recall check 1 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q1A team wants to segment an IoT environment for zero trust. What should be defined before writing broad VLAN or firewall rules?

AOne large trusted IoT segment for every device owned by the same department

BResources, requesters, actions, conditions, and enforcement points.

CA rule that lets every management workstation reach every device at all times

DA list of products that can create network segments automatically

Show answer

Answer: B Zero trust segmentation starts from resources and allowed paths, then maps those paths to enforcement points and proof.

Retrieval practice

Recall check 2 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q2An older endpoint group cannot support modern identity checks and uses a local protocol. Which segmentation pattern best fits zero trust?

APlace the endpoints behind a gateway that authenticates upstream.

BPut all older endpoints in one trusted legacy segment with broad service access

CTurn off monitoring because the endpoints produce few logs

DAllow direct management access whenever maintenance staff are on site

Show answer

Answer: A Gateway mediation preserves accountability and narrows access without treating the older group as a trusted zone.

Retrieval practice

Recall check 3 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q3A gateway authenticates to the upstream service on behalf of many older devices using one shared credential, so every request appears to come from the gateway. What zero trust problem does this create?

AIt collapses per-endpoint identity into the gateway.

BNothing is wrong, because the gateway successfully authenticates to the service

CThe only fix needed is to encrypt the link between the gateway and the service

DDisable service-side logging, since the gateway already logs traffic

Show answer

Answer: A The service loses the originating endpoint identity and cannot authorize or audit requests per device.

Print reference

Answers

Answer key.

B · Zero trust segmentation starts from resources and allowed paths, then maps those paths to enforcement points and proof.
A · Gateway mediation preserves accountability and narrows access without treating the older group as a trusted zone.
A · The service loses the originating endpoint identity and cannot authorize or audit requests per device.