| name | network-segmentation-review |
| description | Review network segmentation and firewall/ACL design for security: zone separation, ruleset hygiene, lateral-movement containment, and zero-trust / microsegmentation. Use to assess or design network architecture defensively (not active testing). |
Goal
An assessment of how well the network limits blast radius: are zones separated, are
firewall rules least-privilege, and is lateral movement contained — with prioritized
fixes.
What to review
- Zoning & trust — segmentation between internet/DMZ/internal/management/OT,
per-environment (prod/dev) and per-tenant separation; where trust changes.
- Firewall / ACL hygiene — overly broad rules (
any/any), unused/shadowed
rules, stale entries, missing egress filtering, default-allow.
- Lateral-movement containment — is the internal network flat? Can one
compromised host reach the whole estate? East-west controls, microsegmentation.
- Management & sensitive planes — isolated management network, jump hosts,
restricted access to admin interfaces, OT/ICS separation.
- Zero-trust posture — identity-aware access vs. pure network location; explicit
allow-listing.
Steps
- Gather topology, firewall rulesets/ACLs, and zone definitions.
- Assess against the areas above; flag broad/stale rules and flat segments.
- Model the lateral-movement blast radius from a typical foothold.
- Recommend segmentation, rule tightening (least privilege, default-deny egress),
and management isolation, prioritized by blast-radius reduction.
Output
A review: zone/rule · issue · severity · fix, plus a target segmentation design and
egress policy. Visualize zones with security-diagramming:architecture-diagram;
report with security-reporting.
Notes
Flat networks are the force-multiplier behind most breaches — containing east-west
movement limits blast radius more than almost any other network control. Hunt broad
(any/any) and stale firewall rules; default-deny egress is commonly missing and
high-value. Pairs with network-pentest (which demonstrates the lateral paths).
