{"id":5300,"date":"2026-09-29T18:27:58","date_gmt":"2026-09-29T18:27:58","guid":{"rendered":"https:\/\/www.netboss.nl\/uncategorized\/network-segmentation-how-far-can-an-attacker-get-after-that-one-infected-laptop\/"},"modified":"2026-09-30T06:53:41","modified_gmt":"2026-09-30T06:53:41","slug":"network-segmentation-how-far-can-an-attacker-get-after-that-one-infected-laptop","status":"publish","type":"post","link":"http:\/\/www.netboss.nl\/en\/blogs-en\/network-segmentation-how-far-can-an-attacker-get-after-that-one-infected-laptop\/","title":{"rendered":"Network Segmentation: How Far Can an Attacker Get After That One Infected Laptop?"},"content":{"rendered":"
<\/span><\/div>

An employee clicks on a link, and his laptop becomes infected. From that moment on, one thing determines how big the problem will become: what that laptop can access. In most networks, the answer is virtually everything, because workstations, file servers, printers, and management ports are all in the same zone. That\u2019s how it evolved over time, and since then, there has never been a quiet moment to reconfigure it differently. <\/span><\/p>\n

Network segmentation is the answer to that problem, though it\u2019s rarely presented that way. Search for it, and you\u2019ll find articles about VLANs, subnets, access control lists, and a six- or seven-step implementation. All of that is correct, and it turns it into a design question. Design questions end up on the IT department\u2019s to-do pile and stay there because they compete with work that needs to be done today. <\/span><\/p>\n

There\u2019s another way to approach this. Start by asking how far someone gets after that first step. Then segmentation becomes a matter of distance. That\u2019s a question a CEO can ask without understanding a single VLAN. In this blog, you\u2019ll learn what network segmentation is, how it differs from microsegmentation, how to implement it without shutting down production, and how to verify that it\u2019s working. <\/span><\/p>\n<\/p>\n

What is network segmentation?<\/b><\/h2>\n

Network segmentation is the division of a network into separate zones, such that traffic between those zones is allowed only if a rule permits it. Without segmentation, any device can reach any other device. <\/span><\/p>\n

Traditionally, this is done using VLANs and subnets, with a firewall or access lists at the boundaries. For example, you create a separate zone for workstations, one for servers, and one for managing your network equipment. Traffic within a zone flows freely, while traffic between zones is subject to a rule. <\/span><\/p>\n

Segmentation doesn\u2019t keep anyone out. That first step comes via a phishing email, a vulnerable system connected to the internet, or a stolen password. A network zone is separate from that. What determines segmentation is what that first step results in: access to a single zone or access to the entire network. <\/span><\/p>\n<\/p>\n

What is lateral movement in a network?<\/b><\/h2>\n

Lateral movement is the step in which an attacker moves from the first infected system to other systems on the same network. That infected laptop is rarely the target; it is the starting point. The stored passwords, mapped network drives, and active sessions on that laptop determine the next step. <\/span><\/p>\n

CrowdStrike measures how long that step takes and refers to it as \u201cbreakout time\u201d: the time between initial access and the first move to another system. In the Global Threat Report dated February 24, 2026, the average breakout time for 2025 was 29 minutes. The fastest observed breakout time was 27 seconds. <\/span><\/p>\n

Compare that to your own response time. A notification has to come in, someone has to review it, someone has to decide what to do, and then something has to be shut down or disconnected. In most organizations, that takes longer than 29 minutes\u2014even when the system is well-organized, and certainly outside of business hours. <\/span><\/p>\n

Horizon3 explains why this won\u2019t get better on its own. AI is changing how vulnerabilities are discovered. It doesn\u2019t change how breaches happen: there will always be another vulnerability and another way in. The distance someone can travel after that first step is therefore the part of the problem you can address in advance. <\/span><\/p>\n<\/p>\n

What is the difference between network segmentation and microsegmentation?<\/b><\/h2>\n

The difference lies in the size of the unit you’re isolating. Network segmentation works with zones that contain multiple devices. Microsegmentation treats the device itself as the unit. <\/span><\/p>\n

Traditional segmentation: zones based on VLANs and subnets<\/b><\/h3>\n

You divide the network into a handful of zones and set rules for the transitions between them. Within a zone, everything remains interconnected. This means that an infection in the workstation zone can still reach every other workstation in that same zone. <\/span><\/p>\n

This works with the equipment you already have, and it\u2019s a familiar technique for any network administrator. The problem lies in practice: any exception that can\u2019t be resolved immediately is resolved by making the zone slightly larger. After a few years, there are more devices connected than were intended in the original design. <\/span><\/p>\n

Microsegmentation: a separate segment for each device<\/b><\/h3>\n

Each device is assigned its own segment and a list of what it is allowed to access. A pump communicates with its control system and no one else. A printer accepts print jobs and has no reason whatsoever to access a file server. <\/span><\/p>\n

An infected device therefore has access only to what it needs during normal use. The attacker may be inside the system, but he cannot go any further than that single device allows. <\/span><\/p>\n

For most organizations, this isn’t a choice between two options. Zones provide a broad classification, while microsegmentation offers a more granular one. You can start with zones and then isolate the devices that have the greatest impact. <\/span><\/p>\n<\/p>\n

What is Zero Trust, and how does segmentation fit into it?<\/b><\/h2>\n

Zero Trust is based on the principle that a user or device is not granted access privileges based on their location. Whether someone is at the office or at home, every access request is evaluated individually. <\/span><\/p>\n

The older model was based on an external boundary: you were considered trusted within the network and not outside of it. That worked as long as everything was located in a single place. With remote work, cloud services, and suppliers remotely accessing the network using their own equipment, that boundary can no longer be clearly defined. <\/span><\/p>\n

Segmentation is the aspect of Zero Trust that takes place within the network itself. Without segmentation, the basic principle remains just a rule on paper: you verify who is coming in, and after that, that device can still access everything. Microsegmentation makes the rule enforceable, because it defines exactly what each device is allowed to do. <\/span><\/p>\n

In addition, there is ZTNA, which stands for Zero Trust Network Access. It applies the same principle to external access: a user connects only to the one application they need. With a traditional VPN, they gain access to the entire network. In that context, segmentation is the foundation of Zero Trust, and ZTNA is the component that sits on the outside. <\/span><\/p>\n<\/p>\n

How do you implement microsegmentation without halting production?<\/b><\/h2>\n

Two concerns prevent most organizations from doing this. Both are valid. You can\u2019t install software on a pump, a PLC, or a camera because the device isn\u2019t designed for it, and the vendor often doesn\u2019t allow it. Additionally, you can\u2019t shut down production to reconfigure the network. <\/span><\/p>\n

An agentless approach eliminates the first concern. Segmentation is enforced at the network level, so no software is installed on the device and no additional hardware is required. As far as the device itself is concerned, nothing changes in how it operates. <\/span><\/p>\n

You can resolve the second objection by addressing the order. You start by figuring out what\u2019s there and who it\u2019s communicating with. That assessment is a step in itself and comes before everything else, because a rule for a device that no one has identified will never be established. Our blog post explains how to do that in an environment with equipment that can\u2019t be scanned: <\/span>Assessing OT Security<\/span><\/a>.<\/span><\/p>\n

Next, set the rules to \u201cview-only\u201d mode. The system records what normally crosses the line and shows which traffic it would block. This way, before closing the road, you can see which traffic would be affected, including traffic that nobody knew was there. Only once that picture is accurate should you activate enforcement. <\/span><\/p>\n

This breaks the rollout down into a series of small steps. You start with one group of devices, make sure everything keeps running, and then move on to the next group. There\u2019s no need for a maintenance window, and there\u2019s never a moment when the entire network goes down at once. <\/span><\/p>\n<\/p>\n

Which devices will be the first to get their own segment?<\/b><\/h2>\n

The order is determined by two characteristics of the device: how far it can reach and what other measurements it can take. A device that can reach far and for which no other measurements apply is listed at the top. <\/span><\/p>\n

    \n
  1. Devices that you can’t install software on.<\/b> Pumps, PLCs, cameras, building management systems, and medical equipment. Endpoint protection doesn\u2019t work on these devices, and patches can often only be applied during a scheduled shutdown. Segmentation is therefore the only measure left. <\/span><\/li>\n
  2. Systems that communicate with many other systems.<\/b> File servers, management servers, and backup environments. By definition, they\u2019re connected to everything, so anyone who gains access to them has the widest reach of all. <\/span><\/li>\n
  3. Everything a supplier focuses on.<\/b> Maintenance access points are almost always wider than necessary because they were designed for situations where something needed to be fixed quickly.<\/span><\/li>\n
  4. Workplaces for people with broad rights.<\/b> Administrators and application administrators have the passwords that an attacker is looking for. An infection there immediately skips a few steps. <\/span><\/li>\n
  5. Devices that no one can install.<\/b> An inventory always reveals a residual category of equipment that communicates but that no one can identify. As long as you don’t know what it is, you also don’t know what it’s allowed to do. <\/span><\/li>\n<\/ol>\n

    This is the same approach used for vulnerabilities, where you first filter based on what is actually accessible before assessing the technical severity. You can read about how this works in the blog post on <\/span>Which vulnerability do you address first?<\/span><\/a>.<\/span><\/p>\n<\/p>\n

    How do you check whether your network segmentation is working?<\/b><\/h2>\n

    A segment you\u2019ve created but never tested is an assumption. That\u2019s a practical consideration, because segmentation tends to drift over time. A new vendor joins and needs access. A rule is relaxed for a project that was supposed to last three months. Additional equipment is added and ends up in the default zone simply because that was the quickest option. Each step is justifiable on its own, and together they restore the zone to its original size. <\/span><\/p>\n

    Checking the configuration helps only to a limited extent, because it shows what was intended. Whether it actually works that way only becomes clear when someone tries it from a workstation. <\/span><\/p>\n

    That\u2019s what an autonomous penetration test does. You deploy it on a workstation as if there were an infection there and see how far it gets: which systems it can access, which login credentials it picks up along the way, and where it ultimately ends up. What you get back are the paths that are currently open. How that works is explained in <\/span>From 8 hours to 10 minutes: Why Your Next Penetration Tester Will Be an AI<\/span><\/a>.<\/span><\/p>\n

    This turns verification into a recurring process. You identify what could go wrong, fix the top-priority issues, and then verify that the path to failure has actually been eliminated. Without that third step, you only know that something has been changed. <\/span><\/p>\n

    The logical time to retest is after every change that affects the network. If not much changes on your end, a regular quarterly check is enough to see if the data is still accurate. <\/span><\/p>\n<\/p>\n

    Where do you start with network segmentation?<\/b><\/h2>\n

    Segmentation starts with knowing what’s there. As long as some of your devices aren’t accounted for, you’re writing rules for devices whose normal behavior you don’t know. Every rule is then a guess. <\/span><\/p>\n

    Next comes the order. Start with the equipment that cannot be controlled by any other measure and with the systems that are connected to everything else. First, set the rules to \u201cview-only\u201d mode so you can see what traffic would be affected before you block anything. Then, enable enforcement on a per-group basis. <\/span><\/p>\n

    The third step is the one that\u2019s most often overlooked. After the initial infection, an attacker takes an average of 29 minutes to move on to the next system. So the security measures you\u2019ve put in place need to work when the time comes. You won\u2019t know if they do until someone has tried to break through. <\/span><\/p>\n

    Want to know how far someone in your network can reach from a single workstation? You can test that. <\/span><\/p>\n

    Go to netboss.nl<\/span><\/p>\n<\/div>

    Schedule a demo with NetBoss \u2192<\/span><\/a><\/div>

    “We’ve Got Your Back”<\/span><\/h3>\n<\/div>

    Frequently Asked Questions About Network Segmentation<\/b><\/h2>\n<\/div>

    <\/i><\/i><\/span>What is network segmentation?<\/span><\/a><\/h4><\/div>
    Segmentation is the process of dividing a network into isolated sections, such that traffic between those sections is allowed only if a rule permits it. The goal is to prevent an infection in one location from spreading to the entire network. <\/span><\/p>\n

    <\/span><\/div><\/div><\/div>

    <\/i><\/i><\/span>Is microsegmentation the same as Zero Trust?<\/span><\/a><\/h4><\/div>
    No. Zero Trust is based on the principle that access is not determined by a person\u2019s location. Microsegmentation is one way to enforce that principle within the network. You can implement microsegmentation without the rest of Zero Trust. Conversely, without segmentation of network traffic, Zero Trust remains nothing more than a rule on paper.
    \n<\/span><\/p>\n

    <\/span><\/div><\/div><\/div>

    <\/i><\/i><\/span>Do you need VLANs for microsegmentation?<\/span><\/a><\/h4><\/div>
    Not necessarily. VLANs are the traditional way to create zones, and they operate at the level of a group of devices. Microsegmentation operates at the level of a single device and can be enforced agentlessly\u2014that is, without a new VLAN configuration and without software on the devices. In practice, the two often coexist.
    \n<\/span><\/p>\n

    <\/span><\/div><\/div><\/div>

    <\/i><\/i><\/span>Does network segmentation fall under NIS2?<\/span><\/a><\/h4><\/div>
    \n

    NIS2 does not prescribe any specific techniques. The directive calls for appropriate measures to manage risks and mitigate the consequences of an incident. Segmentation is one of the measures organizations use to meet these requirements. To find out whether your organization is subject to these requirements and what is expected of you, read our blog about NIS2 in the Netherlands.<\/a> <\/p>\n

    <\/span><\/p>\n

    <\/span><\/p>\n<\/div><\/div><\/div>

    <\/i><\/i><\/span>Is a low EPSS score safe?<\/span><\/a><\/h4><\/div>
    A low score means that abuse is currently unlikely. Scores are recalculated daily, so the situation may be different tomorrow. Furthermore, the score does not indicate whether that system is accessible to you.
    \n<\/span><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":9,"featured_media":5290,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39],"tags":[],"class_list":["post-5300","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogs-en"],"_links":{"self":[{"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/posts\/5300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/comments?post=5300"}],"version-history":[{"count":3,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/posts\/5300\/revisions"}],"predecessor-version":[{"id":5303,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/posts\/5300\/revisions\/5303"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/media\/5290"}],"wp:attachment":[{"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/media?parent=5300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/categories?post=5300"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/tags?post=5300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}