{"id":8441,"date":"2025-09-30T09:39:27","date_gmt":"2025-09-30T07:39:27","guid":{"rendered":"https:\/\/aboveit.fi\/microsegmentation-small-networks-but-great-security\/"},"modified":"2025-11-26T15:53:12","modified_gmt":"2025-11-26T13:53:12","slug":"microsegmentation-small-networks-but-great-security","status":"publish","type":"post","link":"https:\/\/aboveit.fi\/en\/microsegmentation-small-networks-but-great-security\/","title":{"rendered":"Microsegmentation – small networks, but great security"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Local network segmentation is a cybersecurity topic that is discussed too little. Microsegmentation may be perceived as technically too difficult to implement. On the other hand, as services move to the cloud, it may be felt that the organization no longer needs anything other than an internet connection, so why is it still important to talk about network microsegmentation? Above IT Oy’s ‘consigliere’ Matias Haapaniemi<\/a> delved into this often overlooked topic in his latest blog. Read on! <\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

When a firewall alone is no longer enough<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Traditionally, corporate networks have been protected by a firewall at the network edge, which acts like a strong gate in a castle. It only allows permitted traffic in and out. But what happens if an adversary somehow gets inside the castle walls? Imagine a situation where an employee clicks on a phishing email link and accidentally installs malware on their computer. The attacker is now inside the network, behind the firewall. Without any internal restrictions, this malware can quickly spread throughout the entire local network. The situation is like an office building where only the front door is locked. Once inside, all rooms and spaces are freely accessible without any restrictions. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What is microsegmentation?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Microsegmentation means dividing the network into smaller, isolated parts, each of which is protected separately. This strategy creates multiple compartments and “internal doors” in the network, which limit a potential attacker’s lateral movement within the local network. Even if one part of the network is breached, the attacker cannot easily move to other parts. Damage can be contained to just one part of the network. Microsegmentation has become an important cybersecurity method for small and medium-sized businesses as well, as in modern networks, a traditional firewall at the network edge alone is no longer sufficient to keep threats at bay. <\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Layer 2 segmentation using VLANs<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Network segmentation can be implemented at different levels. Layer 2 segmentation refers to segmentation at the data link layer, essentially isolating devices into their own local networks at the switch and MAC address level. Using VLANs (Virtual Local Area Networks), devices physically connected to the same switch can be logically divided into different network segments, as if they were on different switches. For example, all office printers can be placed in VLAN 10 and employees’ computers in VLAN 20. Even if they are physically connected to the same network device, they do not belong to the same “local network” and cannot directly communicate with each other without a firewall. <\/p>

What types of VLANs should a company have?
It strongly depends on the organization, but these are a good starting point:<\/p>