Corporate network segmentation: How to protect critical business systems from cyber threats

Why traditional network protection approaches are no longer sufficient for critical systems

Ukrainian businesses operate amidst an unprecedented rise in cyber threats. According to CERT-UA, 2,530 cyber incidents were registered in 2023 [2]. Attacks are becoming more targeted, affecting government agencies, the defense sector, energy, and commercial organizations. Among the most common threats are malware propagation, phishing, and account compromise.

Traditional perimeter defense, which focuses on creating strong external barriers, proves insufficient when attackers penetrate the network. After a successful breach, attackers use lateral movement techniques to spread through the network from the initial entry point to their primary target. This allows them to gain access to critical data and systems, causing significant damage. Network segmentation is a key tool for preventing such threat propagation, limiting the “blast radius” in the event of a successful attack.

Critical business systems: What exactly needs protection?

Critical business systems are the heart of any enterprise, ensuring its continuous operation and safeguarding its most valuable assets. These include Enterprise Resource Planning (ERP) systems, financial systems, Customer Relationship Management (CRM) systems, Industrial Control Systems (ICS/SCADA), and other information and communication systems that process state information resources or restricted access information. Compromise of these systems can lead to catastrophic consequences: from financial losses and confidential data leaks to operational downtime and significant reputational damage. For example, the cyberattack on Kyivstar in December 2023 caused estimated damages of approximately 3.6 billion UAH [1]. Protecting these systems requires special attention to data availability, integrity, and confidentiality.

Regulatory requirements in Ukraine: NBU and SSSCIP as drivers for segmentation

In Ukraine, regulatory bodies are actively tightening cybersecurity requirements, making network segmentation not just desirable but mandatory for many enterprises. The National Bank of Ukraine (NBU) has developed requirements for the functioning of the cybersecurity system in the banking system (NBU Board Resolution No. 178 of August 12, 2022 [3]) and for non-bank financial institutions (NBU Board Resolution No. 179 of August 12, 2022 [4]). These documents define the basic principles of cybersecurity organization, information exchange principles, and requirements for cybersecurity measures for critical information infrastructure objects, as well as introducing a risk-oriented approach to information security and cybersecurity. Network segmentation helps financial institutions comply with these requirements by isolating critical systems and data.

The State Service of Special Communications and Information Protection of Ukraine (SSSCIP) is the main subject of the national cybersecurity system. It sets requirements for information protection, especially for critical information infrastructure objects (CIIO) and providers working with the public sector. According to the Law of Ukraine “On Information Protection in Information and Communication Systems” [5], state information resources or restricted access information must be processed in authorized security systems or by obtaining an information security compliance certificate. Network segmentation is a key measure for building such secure systems and obtaining compliance certificates for comprehensive information protection systems (CIPS).

Architectural approaches to corporate network segmentation

The choice of segmentation approach depends on the organization's size, security needs, and available resources. Let's consider the main architectural approaches:

• VLAN segmentation (Virtual Local Area Networks): This is a traditional approach that divides a network into logical segments using switches. VLANs are cost-effective and relatively simple to implement for basic network separation, for example, by department. However, they have limitations in precision and can be vulnerable in shared zones, making them less effective for protecting critical systems from lateral threat movement.
• Firewall zones: This approach involves using physical or virtual firewalls to create isolated security zones. The firewall controls and filters traffic between these zones according to predefined rules, providing protection against unauthorized access and malicious software. This provides better control than VLANs alone but may still not be granular enough to protect individual critical applications.
• Microsegmentation: This modern approach uses software-defined policies to create isolated segments at a granular level, for example, between individual virtual machines, containers, or workloads. Microsegmentation significantly reduces the attack surface, provides east-west traffic control (within the data center), and effectively prevents lateral threat movement. It allows for the application of highly specific security policies for individual applications and services, limiting interaction to the necessary minimum.
• Software-Defined Segmentation (SDN/SDP): Software-Defined Networks (SDN) separate the control plane from the data plane, allowing centralized management of network devices through software applications. This provides increased flexibility, scalability, and security. Software-Defined Perimeter (SDP) is one implementation of SDN that creates dynamic, individualized network segments for each connecting user or device, providing access only to necessary resources. Such an architecture is the basis for implementing microsegmentation and Zero Trust principles.

Comparison of network segmentation approaches

Implementation challenges: How to overcome complexity and optimize costs

Implementing granular network segmentation, especially microsegmentation or software-defined approaches, can be complex and require significant investment. Key challenges include: managing numerous access policies, potential impact on network performance, and significant upfront costs.

To overcome these challenges, a strategic approach is necessary. Start with thorough planning and phased implementation, focusing initially on the most critical business systems. Develop clear access policies based on the principle of least privilege, allowing systems to interact only as necessary. Use automation tools for policy management and network activity monitoring to simplify administration and help detect anomalies. Performance impact assessment should be conducted during the design and testing phases to ensure optimal configuration. While calculating the Return on Investment (ROI) for segmentation can be complex, as it includes not only direct financial benefits but also risk reduction, increased resilience to attacks, and compliance with regulatory requirements, specialized frameworks such as NIST Cybersecurity Framework or ISO 27001 can be used for its assessment. Segmentation contributes to reducing the consequences of cyber incidents and facilitates their investigation.

Segmentation as the foundation of a Zero Trust strategy

Network segmentation is a fundamental component of a Zero Trust architecture. The Zero Trust principle states “never trust, always verify,” meaning no user or device is trusted by default, even if it is within the network perimeter. Every access request must be authenticated and authorized, and access is granted only to those systems strictly necessary to perform the task (the principle of least privilege).

Microsegmentation, in particular, implements this principle by isolating individual workloads, applications, and data into small, secure zones. This prevents lateral threat movement, even if an attacker penetrates one segment. Integrating segmentation with other Zero Trust elements, such as Multi-Factor Authentication (MFA) and Identity and Access Management (IAM), creates a multi-layered protection architecture that significantly enhances enterprise cyber resilience and protects critical assets from sophisticated cyberattacks.

Sources

1. ¹
2. ²
3. ³
4. ⁴
5. ⁵

Softline IT, as a system integrator, possesses expertise in designing, implementing, and supporting comprehensive cybersecurity solutions.

Softline IT assists in planning and implementing cybersecurity solutions: from auditing the current state to a coordinated plan for changes.

Softline IT helps teams plan and implement cybersecurity, from an assessment of the current environment to an agreed change plan.

Author of the materialTetiana VerbytskaIT Services & Licensing EditorView profile →