Secure Network Design and Segmentation

Secure network design and segmentation is the practice of dividing a computer network into smaller, isolated sections to control traffic flow and limit the damage of a security breach. Think of a flat network – one where every device can talk directly to every other device – like a single-room house where an intruder can see everything at once. Segmentation breaks that house into separate rooms with locked doors, so an attacker breaking into the living room cannot automatically access the bedroom safe. This is critical because modern networks are huge, connecting thousands of devices like servers, laptops, printers, and IoT gadgets. Without segmentation, a single infected laptop could spread malware across the entire organisation in minutes.

At the heart of segmentation are a few key technologies. A Virtual Local Area Network (VLAN) is a logical grouping of devices that behave as if they are on their own separate physical network, even if they share the same switch. For example, all computers in the HR department can be on VLAN 10, and all computers in Engineering on VLAN 20. Traffic between VLANs must go through a device called a router or a firewall, which inspects the traffic and decides whether to allow it. This is where a firewall, a device that permits or blocks network traffic based on security rules, comes in. A firewall can be configured to allow only specific types of traffic between VLANs – for instance, allowing HR to access a shared database server but blocking Engineering from doing so.

A subnet, or subnetwork, is a more fundamental way to divide an IP network. Whereas VLANs are a layer-2 concept (they handle local network addressing), subnets are a layer-3 concept (they handle IP addresses). In practice, VLANs and subnets are often paired: each VLAN gets its own subnet. For example, VLAN 10 might use the subnet 192.168.10.0/24, which can host up to 254 devices. Segmentation also relies on Access Control Lists (ACLs), which are sets of rules applied to routers or firewalls that specify which traffic is permitted or denied based on source IP, destination IP, port numbers, and protocol. A common ACL rule might say 'allow traffic from the Finance subnet to the accounting server on port 1433 (SQL) but deny all other traffic.'

Secure network design also introduces the concept of zones. A zone is a collection of network segments with similar security requirements. Typical zones include a trusted zone (internal corporate network), an untrusted zone (the internet), a demilitarised zone (DMZ) for public-facing servers like web servers, and a guest zone for visitors' Wi-Fi. The DMZ is particularly important – it is a buffer zone that sits between the internal network and the internet. Servers in the DMZ are accessible from the internet but cannot initiate connections into the internal network, which prevents an attacker who compromises a web server from directly attacking internal databases.

Why does this matter for the 350-701 exam? The Cisco SCOR exam tests your understanding of how to design a network using these concepts to achieve defence in depth – a layered security strategy. You need to know the difference between east-west traffic (traffic between devices within the same data centre or segment) and north-south traffic (traffic entering or leaving the network). Most security policies focus on north-south traffic, but modern segmentation places equal emphasis on east-west traffic because attackers often move laterally once inside. Technologies like microsegmentation take this further by applying security rules to individual workloads, even within the same VLAN, often using software-defined networking (SDN) or virtual firewalls.

The exam also expects you to recognise that segmentation is not just about technology but about policy. You start by identifying assets (what needs protecting), classifying data sensitivity, and then mapping traffic flows. A typical design follows the 'least privilege' principle: every segment only has access to the specific resources it needs to function. This is often documented using a network diagram with clear labels for each zone, VLAN, and firewall rule. Finally, you must understand that segmentation can be implemented at multiple layers:

The 350-701 exam will ask you to select the appropriate segmentation method for a given scenario, identify the correct placement of firewalls, and understand how segmentation prevents threats like ransomware propagation. You must also know that a well-segmented network makes compliance with regulations like GDPR or HIPAA easier because sensitive data is isolated and more easily monitored.

An IT professional responsible for network security typically starts by gathering requirements from the business. For example, a mid-sized company with 500 employees wants to secure its network after a recent ransomware attack in the news. The IT professional's first step is to interview department heads to understand what data each department handles. The finance team manages payroll and bank details, HR holds personal employee records, research and development has intellectual property, and the sales team uses a customer relationship management (CRM) tool hosted in the cloud. The IT professional then creates a network segmentation plan.

Step by step, the IT professional does the following:

In a real-world scenario, the IT professional also faces challenges like dealing with legacy systems that cannot be moved to new VLANs, or employees who demand open access between departments. The professional must balance security with usability, often by implementing jump servers – locked-down computers that allow authorised administrators to access high-security segments from a less secure network. This real-world process demonstrates that segmentation is not a one-time project but an ongoing cycle of assessment, design, implementation, and monitoring, which directly maps to the concepts tested in the 350-701 exam.