A8.22 Segregation of networks

Segregation of networks involves separating networks or systems into distinct segments to control access, reduce the attack surface, and limit the spread of malware or unauthorized activity. This principle of “least privilege” in networking helps protect sensitive systems and data by isolating them from less secure parts of the network.

ISO 27001 A8.22 Segregation of networks emphasizes that systems and services should be isolated based on their sensitivity, function, or trust level to enhance overall security posture. Segregation can be implemented physically or logically using technologies such as VLANs, firewalls, and access control lists (ACLs).

Implementation Guide #

Step 1: Define Network Segregation Requirements

• Identify critical systems (e.g., financial, HR, R&D, production) and assess the need for segregation.
• Define trust zones and map out data flow between zones.
  → Tool Recommendation: Lucidchart, io, or Microsoft Visio for visual mapping of zones and flows.

Step 2: Implement Logical or Physical Segmentation

• Use VLANs, subnets, and access control lists to create isolated segments within the same physical network.
• In high-security environments, use separate physical interfaces or switches.
  → Tool Recommendation: Cisco Catalyst, Fortinet, pfSense, Ubiquiti UniFi for VLAN and firewall implementation.

Step 3: Deploy Inter-Segment Controls and Firewalls

• Control and monitor traffic between segments using firewalls or next-generation firewalls (NGFW).
• Apply strict rules that only allow necessary communication between network zones.
  → Tool Recommendation: Palo Alto Networks, FortiGate, Check Point, SonicWall

Step 4: Restrict Administrative Access Across Segments

• Use jump servers (bastion hosts) to manage access to secure zones from a central point.
• Enforce multi-factor authentication (MFA) and role-based access.
  → Tool Recommendation: CyberArk, BeyondTrust, or Delinea for privileged access to segregated networks.

Step 5: Monitor Segmented Networks for Compliance and Anomalies

• Monitor traffic between segments to detect and alert on suspicious activity.
• Use SIEM tools for correlation and reporting.
  → Tool Recommendation: Splunk, Wazuh, QRadar, ELK Stack

Step 6: Review and Maintain Segregation Rules

• Regularly audit segmentation rules and ensure they align with current business and security needs.
• Update VLANs, firewalls, and access controls when systems or organizational structures change.
  → Tool Recommendation: ManageEngine Firewall Analyzer, Tufin, or AlgoSec

Templates #

• Network Segmentation Policy
• Trust Zone Mapping Template
• Firewall and VLAN Rule Configuration Checklist
• Jump Server Access Procedure
• Network Segregation Change Request Form

Example #

A healthcare organization had a flat network where all devices, including patient systems, workstations, and printers, could communicate freely. This setup increased the risk of malware spreading. After segmenting the network using Cisco VLANs and placing critical systems behind FortiGate firewalls, they isolated medical devices and sensitive data. Additionally, Splunk was used to monitor inter-VLAN traffic, improving threat detection and response time.

How to Comply #

To comply with ISO 27001 A.8.22, organizations should:

• Define zones based on function and sensitivity.
• Apply physical or logical segmentation through VLANs and firewalls.
• Control and monitor inter-zone traffic.
• Regularly audit and maintain segmentation strategies.

How to Pass an Audit #

Key Documents to Prepare:

• Network Segmentation Plan and Diagrams
• Firewall and VLAN Configuration Files
• Access Control and Jump Server Logs
• Segmentation Review Reports
• Segregation Policy and Procedures

What the Auditor Will Check:

• Is there effective segmentation between critical and non-critical systems?
• Are there access controls and monitoring in place between segments?
• Are there documented policies and procedures for maintaining segregation?

Top 3 Mistakes People Make #

• Relying solely on flat networks with no segmentation.
• Using VLANs without proper inter-VLAN access controls.
• Failing to document or review segmentation changes regularly.

ISO 27001 Network Segregation FAQ #

Q1: What’s the difference between segmentation and isolation?
Segmentation limits and controls communication; isolation blocks it entirely. Use isolation for highly sensitive or untrusted systems.

Q2: Can we segment cloud networks?
Yes. Cloud platforms like AWS, Azure, and Google Cloud support network segmentation through virtual private clouds (VPCs), subnets, security groups, and network ACLs.

Q3: Do all organizations need physical separation of networks?
Not necessarily. Logical segmentation using VLANs and access controls is sufficient for most environments unless higher security is required.

ISO 27001 Controls and Attribute Values #

Segregating networks helps reduce lateral movement in case of a breach and limits the exposure of sensitive assets, forming a critical part of a defense-in-depth strategy.