Authentication & Access · Study deck

Microsegmentation and East-West Control

Picture a temperature sensor that should send readings to one building service.

Shield Shelly is your guide for this deck.

zero-trustnetwork-segmentationmicrosegmentation

Shield Shelly, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain: The zero trust segmentation question is not "which network is the sensor on?" but "which subject may perform which action on which resource, through which enforcement point, and what proves every other path stays closed?".
Explain: This overview gives the practitioner a way to stop trusting location: maintain inventory accountability, watch for policy drift, test east-west denials, and look under the hood for any bypass path.
Explain: Drift and the Limits of Observe Mode Segmentation decays as new devices, support paths, firmware behaviors, temporary exceptions, and emergency workarounds are added without review.

Major section

Design From the Path, Not the Subnet

It shares the site with cameras, door controls, and staff systems.

Placing it inside the building network does not explain why it should reach only its own service.
Telemetry means readings and status sent by a remote device.
The useful path should remain open.
The practical consequence is a change in the unit of design.

A flat IoT network changing into resource-centered zero trust paths where devices, gateways, dashboards, and services can reach only approved resources.

Major section

Design From the Path, Not the Subnet (continued)

Every neighbouring path should fail closed and leave a clear reason without relying on the sensor's location as proof of trust.

This small path test does not prove the whole site is secure.
The deeper sections show how resource lists, enforcement placement, rule drift, bypass checks, and repeated denial tests limit movement after one device is compromised.
A VLAN by itself is a label, not a control.

Major section

Design From the Path, Not the Subnet (continued)

The zero trust segmentation question is not "which network is the sensor on?" but "which subject may perform which action on which resource, through which enforcement point, and what proves every other path stays closed?".

Network location can still be a useful signal, but it must not become the reason a device is trusted.
The guiding principle, set out in the NIST zero trust architecture, is to never grant access based on location alone and to verify each request against a policy.
The next sections use that resource-path model to define policy fields and choose enforcement points.

Major section

Design From the Path, Not the Subnet (continued)

Designing this way directly limits east-west movement, the lateral hops an attacker uses to spread, which is the same as limiting the blast radius of any single compromise.

This overview gives the practitioner a way to stop trusting location: maintain inventory accountability, watch for policy drift, test east-west denials, and look under the hood for any bypass path.
The One-Minute View Resources first, not location Start from what must be protected and who needs it, not from which subnet a device happens to join.
Allowed path, not trusted zone A segment is not a container of mutual trust.

Major section

Write and Enforce Allowed Paths

The work is to turn "least access" into reviewable records and to put enforcement where a path can actually be denied.

IoT gives you several layers, and a strong design combines them rather than trusting one.
Monitoring records the decisions across those boundaries.
Weak isolation lets wireless peers still discover each other.

Zero trust segmentation enforcement placement showing wireless edge, switch or firewall boundary, local gateway, service API, data store, and monitoring evidence.

Major section

Write and Enforce Allowed Paths (continued)

The comparison prepares the ledger by showing why one broad firewall rule cannot enforce every path with the same precision.

Final check even if a network rule is wrong.
Skipping it trusts the network to be perfect.
Each rule can now name its subject, resource, action, conditions, enforcement point, and evidence.

Major section

Keep Lateral Movement Denied

The deeper layer explains the mechanics that make or break IoT segmentation: lateral movement, who actually gets identified at the enforcement point, and how policy decays.

Microsegmentation enforces per-resource policy so one compromised sensor cannot hop to its neighbour.
Wireless lateral paths must be tested directly, not assumed to be covered by segment labels.

East-west controls in zero trust segmentation showing peer device paths denied, approved gateway paths allowed, management path isolated, and monitoring observing denied attempts.

Major section

Keep Lateral Movement Denied (continued)

Gateways are essential for constrained endpoints, but mediation must preserve the originating identity rather than forwarding everything under one shared credential.

Devices cannot move laterally to neighbours, permitted traffic crosses the gateway, management remains isolated, and monitoring observes both grants and denials.
Per-path record with allow and deny tests.
Lateral hops between devices are blocked.

Major section

Keep Lateral Movement Denied (continued)

Constrained devices reach resources with accountability.

Devices cannot talk laterally, approved traffic passes through the gateway, management remains on a separate controlled path, and monitoring observes both grants and denials.
Wireless Lateral Movement Wireless groups need explicit treatment, because a shared wireless network can become an accidental trusted zone.
Wireless peers cannot freely reach each other.

Major section

Keep Lateral Movement Denied (continued)

A segment becomes a trusted container with open peers.

Without separate admission for IoT, management, guest, and operator devices, and without client isolation, wireless peers can still discover and reach each other even when the wired policy looks tight.
Weak admission lets peers discover and connect.
Reopened or new paths are noticed.

Major section

Keep Lateral Movement Denied (continued)

IoT deployments fail at east-west because devices on the same local network can reach peers directly.

Drift and the Limits of Observe Mode Segmentation decays as new devices, support paths, firmware behaviors, temporary exceptions, and emergency workarounds are added without review.
And because routing changes and workarounds can reopen a closed path, denied-path tests are repeated, not run once at rollout.
New-destination alerts and repeated denied-path tests.

Deck summary

Key takeaways

It shares the site with cameras, door controls, and staff systems.

Every neighbouring path should fail closed and leave a clear reason without relying on the sensor's location as proof of trust.
The zero trust segmentation question is not "which network is the sensor on?" but "which subject may perform which action on which resource, through which enforcement point, and what proves every other path stays closed?".
Designing this way directly limits east-west movement, the lateral hops an attacker uses to spread, which is the same as limiting the blast radius of any single compromise.
Constrained devices reach resources with accountability.

Retrieval practice

Recall check 1 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q1A team wants to segment an IoT environment for zero trust. What should be defined before writing broad VLAN or firewall rules?

AOne large trusted IoT segment for every device owned by the same department

BA rule that lets every management workstation reach every device at all times

CResources, requesters, actions, conditions, and enforcement points.

DA list of products that can create network segments automatically

Show answer

Answer: C Zero trust segmentation starts from resources and allowed paths, then maps those paths to enforcement points and proof.

Retrieval practice

Recall check 2 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q2An older endpoint group cannot support modern identity checks and uses a local protocol. Which segmentation pattern best fits zero trust?

APut all older endpoints in one trusted legacy segment with broad service access

BTurn off monitoring because the endpoints produce few logs

CAllow direct management access whenever maintenance staff are on site

DPlace the endpoints behind a gateway that authenticates upstream.

Show answer

Answer: D Gateway mediation preserves accountability and narrows access without treating the older group as a trusted zone.

Retrieval practice

Recall check 3 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q3A gateway authenticates to the upstream service on behalf of many older devices using one shared credential, so the service sees every request as coming from the gateway. What zero trust problem does this create, and how should it be fixed?

AIt collapses per-endpoint identity into the gateway.

BNothing is wrong, because the gateway successfully authenticates to the service

CThe only fix needed is to encrypt the link between the gateway and the service

DDisable service-side logging, since the gateway already logs traffic

Show answer

Answer: A A single authenticated gateway must not become a blanket pass.

Print reference

Answers

Answer key.

C · Zero trust segmentation starts from resources and allowed paths, then maps those paths to enforcement points and proof.
D · Gateway mediation preserves accountability and narrows access without treating the older group as a trusted zone.
A · A single authenticated gateway must not become a blanket pass.