The single factor that most determines how bad a ransomware incident becomes is not the malware. It is whether the compromised laptop could reach the file server, the backup server, the CCTV recorder and the finance workstation directly. In a flat network it can reach all of them, so one careless click becomes a company-wide event.
Everyone knows this. The reason it does not get fixed is that "segment the network" sounds like a project that stops the business for a weekend and might not come back up. It does not have to be. Here is the staged approach we use, ordered so each stage is independently useful and independently reversible.
Stage 0: find out what actually talks to what
Do not skip this and do not guess. Every segmentation project that has gone wrong went wrong here.
Enable NetFlow or sFlow on the core switch and collect for at least two weeks, ideally including a month-end. Month-end is when the finance system talks to things nobody remembered. You are building a map of which sources talk to which destinations on which ports, and you will find surprises: a print server that turns out to be running a licence service, a workstation under a desk acting as a database host, a supplier with a permanent VPN into a machine nobody can identify.
The output of this stage is a document, not a change. It is also, on its own, worth the effort: most clients discover several things that should be switched off entirely.
Stage 1: separate the obviously separate
Start with the zones that have no legitimate reason to reach production at all. These are low-risk, high-value and can usually be done in an evening each.
- Guest Wi-Fi. If a visitor's phone can see the server VLAN, fix that tonight. Guest traffic goes straight out to the internet and touches nothing else.
- CCTV and physical security. Cameras and recorders are frequently unpatched and running old embedded operating systems. They need to talk to their recorder and their management station, and nothing else.
- Building services. Air conditioning controllers, UPS management cards, access control panels, lift systems. Same reasoning.
- Printers. They rarely need to originate connections to anything.
None of this affects a single business user if it is done correctly, which makes it the ideal place to build confidence and prove the change process.
Stage 2: put the management plane somewhere safe
Switch, firewall, hypervisor, storage and UPS management interfaces belong on a dedicated VLAN reachable only from named administrator workstations or a jump host, with multi-factor authentication in front of it.
This is the highest-value single change after guest separation, because it directly interrupts the path attackers use to go from a foothold to controlling the infrastructure. It also costs almost nothing, since the devices are already there and only their management addresses move.
Stage 3: split users from servers
Now the real work starts. Users on their own VLANs, servers on theirs, with a firewall between rather than a router that forwards everything.
Run the policy in monitor mode first. Log what would be denied, review for two weeks, and expect to find legitimate flows your Stage 0 capture missed. Only then start enforcing, and enforce by tightening gradually rather than by switching from allow-all to deny-all in one step.
The temptation here is to build dozens of micro-segments immediately. Resist it. Two zones you can actually maintain beat fifteen that nobody understands in six months.
Stage 4: isolate the crown jewels
Some systems justify their own zone with explicitly enumerated access:
- Backup infrastructure. Nothing in production should be able to reach the backup repository, and backup credentials should not exist in your production directory.
- Domain controllers. Restrict administrative protocols to the management zone.
- Payment and cardholder systems. Segmentation here also shrinks your PCI DSS assessment scope, which is a commercial argument as well as a security one.
- OT and industrial systems. Plant networks should reach the corporate network through a controlled conduit, never directly.
Stage 5: control the east-west traffic inside a zone
Workstations very rarely need to connect to each other. Blocking peer-to-peer SMB and RDP between user machines removes the lateral movement technique that most commodity ransomware relies on. Depending on your platform this is host firewall policy, private VLANs, or micro-segmentation in the hypervisor.
Sequencing rule. Each stage should be deployable on a Tuesday evening and reversible in fifteen minutes. If a proposed change cannot meet both tests, it is too big. Split it.
Mistakes we see
- Designing from a diagram instead of from traffic data. The diagram describes what someone intended in 2019.
- Going straight to deny-all. You will break something invisible and lose organisational support for the whole programme.
- Segmenting the network but not identity. If one domain admin account is used everywhere, the VLANs are decoration.
- Forgetting the documentation. An undocumented segmented network becomes a flat one again within eighteen months, one exception at a time.
- No exception process. If getting a firewall rule takes three weeks, someone will plug a cable in and route around you.
What it is worth
In the FMCG ransomware incident our team handled last year, the attacker had domain administrator rights within four hours. What limited the damage was that the backup repository sat in its own zone with its own credentials and could not be reached from the compromised production network. The company was back in production in thirty-one hours and paid nothing.
That was one VLAN and about a dozen firewall rules. It is the best return on a day's work we have ever measured.