--- id: CP-228 slug: network-segmentation-vlan-micro-segmentation lang: en title: Network segmentation and VLANs against ransomware description: Splitting a network into zones (VLANs, internal firewalls, micro-segmentation) limits ransomware. What employees do to make it hold. canonical_url: https://startbrain.io/cyberpedia/en/articles/network-segmentation-vlan-micro-segmentation/ markdown_url: https://startbrain.io/cyberpedia/en/articles/network-segmentation-vlan-micro-segmentation.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Network segmentation and VLANs against ransomware", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/network-segmentation-vlan-micro-segmentation/ (CC BY 4.0) wing: 3 theme: browse_safely reflex: cr-079 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/network-segmentation-vlan-micro-segmentation/ fr: https://startbrain.io/cyberpedia/fr/articles/segmentation-reseau-vlan-micro-segmentation/ de: https://startbrain.io/cyberpedia/de/articles/netzwerksegmentierung-vlan-mikrosegmentierung/ es: https://startbrain.io/cyberpedia/es/articles/segmentacion-red-vlan-microsegmentacion/ sources: - "n": 1 title: Data Encrypted for Impact, Technique T1486 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1486/ accessed: "2026-11-03" - "n": 2 title: "#StopRansomware Guide | CISA" publisher: CISA url: https://www.cisa.gov/stopransomware/ransomware-guide accessed: "2026-11-03" - "n": 3 title: Network Segmentation, Mitigation M1030 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/mitigations/M1030/ accessed: "2026-11-03" - "n": 4 title: Zero trust architecture design principles publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/zero-trust/architecture-design-principles accessed: "2026-11-03" - "n": 5 title: SP 800-207, Zero Trust Architecture | CSRC publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/207/final accessed: "2026-11-03" - "n": 6 title: Remote Services, Technique T1021 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1021/ accessed: "2026-11-03" - "n": 7 title: "Remote Services: SMB/Windows Admin Shares, Sub-technique T1021.002 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1021/002/ accessed: "2026-11-03" - "n": 8 title: Exploitation of Remote Services, Technique T1210 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1210/ accessed: "2026-11-03" - "n": 9 title: Lateral Tool Transfer, Technique T1570 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1570/ accessed: "2026-11-03" --- # Network segmentation and VLANs against ransomware Ransomware rarely stops at the first computer it hits. According to MITRE ATT&CK, encryption software can spread through a network, worm-like, to encrypt the data of a large number of machines and maximize damage [1]. Splitting the network into sealed zones is one of the responses to this risk. This page explains what the terms VLAN, internal firewall and micro-segmentation cover, what an employee can do to make this split hold, and the pitfalls that make it ineffective. ## In 30 seconds - Where it happens: on the company's internal network, once a workstation or an account is compromised. - What the attacker wants: to move from one machine to others to encrypt as much data as possible [1]. - If it has already happened: tell IT or security right away, and they will isolate the workstation; if asked, unplug the cable or turn off Wi-Fi [2]. - The reflex: do not plug in any unauthorized device or media, stay on the network intended for your use, and quickly report a workstation that behaves oddly so that it can be isolated. ## Straight answers ### What is network segmentation? It is the splitting of a network into smaller, isolated segments, to control traffic between devices, systems and applications. MITRE ATT&CK states that this reduces the attack surface, slows the attacker's movements and protects critical assets [3]. ### What are a VLAN and an internal firewall? MITRE ATT&CK describes a separation made of physical boundaries, logical separation by VLAN and access rules enforced by equipment such as firewalls and routers [3]. A VLAN is therefore a logical separation, and the internal firewall controls what passes from one segment to another. ### And micro-segmentation? It is the same principle at the scale of each workload. MITRE ATT&CK recommends software-defined networking tools to segment at that level and prevent lateral movement [3]. ### Why does this concern an employee? Because segmentation can be bypassed by a user error. CISA specifies that it can become ineffective when the organization's rules are not followed, for example by connecting removable media or other devices to several segments [2]. ## How it works The principle is to group systems by function, sensitivity and risk. MITRE ATT&CK gives payment systems, HR databases, production systems and Internet-facing servers as examples [3]. Web, DNS and mail servers reachable from outside are placed in a demilitarized zone (DMZ), with strict filtering rules toward the internal network [3]. The rules follow a deny-by-default logic: access control lists on network equipment, and firewalls that limit both traffic between outside and inside and traffic between internal machines [3]. MITRE ATT&CK also recommends separating Wi-Fi and wired networks, notably when the wired network gives access to sensitive resources [3]. CISA recommends separating the organization's services or departments and keeping a separation between conventional IT and industrial systems. Its guide presents a diagram of a "flat" (unsegmented) network and a diagram of a segmented network [2]. The British NCSC goes further with "zero trust": the trust inherent in the network is removed, the network is considered hostile and each request is verified against an access policy [4]. For NIST, this approach shifts defense from static perimeters to users, assets and resources [5]. NIST says that zero trust protects resources, not network segments [5]. ## What you do - Do not plug in unauthorized devices, either into a network socket or into a workstation. CISA cites connecting removable media or devices to several segments as a cause of segmentation failure [2]. - Use the network intended for your use. MITRE ATT&CK recommends separating Wi-Fi and wired environments when the latter gives access to sensitive resources [3]. - Quickly report a suspicious workstation to IT or security, who isolate the affected systems in a coordinated way. If asked, unplug the network cable or turn off Wi-Fi: CISA presents unplugging devices as a fallback when taking them offline is not immediately possible [2]. - Do not power off on your own without instructions. CISA states that cutting power loses traces in memory and is done only if disconnection is impossible otherwise [2]. ## Pitfalls The flat network. When everything talks to everything, a single compromised workstation opens access to the rest. MITRE ATT&CK notes that with valid domain credentials, an attacker can connect to many machines through remote access protocols such as SSH or RDP [6]. A VLAN without filtering. Separating is not enough if nothing controls what passes. MITRE ATT&CK asks for firewall rules that block RDP traffic between security zones and for deny-by-default on access control lists [3]. It also recommends regularly reviewing the rules, monitoring traffic flows and testing segmentation with periodic penetration tests [3]. Rules that are too broad. MITRE ATT&CK recommends allowing only the necessary ports and traffic [3]. A rule that lets everything through removes the point of the zone. Unsegregated administration. The hidden Windows administrative shares (C$, ADMIN$, IPC$) allow remote file copying and other administrative functions, and an attacker can use them with a valid administrator account [7]. For WinRM, MITRE ATT&CK advises isolating critical enclaves with separate infrastructure and restricting access to specific devices [3]. Vulnerable servers reachable from everywhere. Known flaws exist in common services such as SMB and RDP, as well as in internal applications such as MySQL [8]. MITRE ATT&CK recommends segmenting to reduce access to critical systems to controlled methods [3]. Tool copies from one machine to another. An attacker can copy files between internal systems with sharing protocols such as SMB or an authenticated RDP connection [9]. ## Real cases ### 2016: attack on the Ukrainian power grid According to MITRE ATT&CK, during the 2016 attack on the Ukrainian power grid, the Sandworm Team group used the net use command to connect to network shares [7]. The sources cited here give no further detail on this episode. ### The APT28 "Nearest Neighbor" campaign MITRE ATT&CK states that, during the "Nearest Neighbor" campaign, APT28 used SMB to transfer files and move laterally [7]. The sources cited here give no date for this campaign. ## Sources 1. MITRE ATT&CK, "Data Encrypted for Impact, Technique T1486 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1486/ (accessed 3 November 2026) 2. CISA, "#StopRansomware Guide | CISA". https://www.cisa.gov/stopransomware/ransomware-guide (accessed 3 November 2026) 3. MITRE ATT&CK, "Network Segmentation, Mitigation M1030 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/mitigations/M1030/ (accessed 3 November 2026) 4. NCSC (UK), "Zero trust architecture design principles". https://www.ncsc.gov.uk/collection/zero-trust/architecture-design-principles (accessed 3 November 2026) 5. NIST, "SP 800-207, Zero Trust Architecture | CSRC". https://csrc.nist.gov/pubs/sp/800/207/final (accessed 3 November 2026) 6. MITRE ATT&CK, "Remote Services, Technique T1021 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1021/ (accessed 3 November 2026) 7. MITRE ATT&CK, "Remote Services: SMB/Windows Admin Shares, Sub-technique T1021.002 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1021/002/ (accessed 3 November 2026) 8. MITRE ATT&CK, "Exploitation of Remote Services, Technique T1210 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1210/ (accessed 3 November 2026) 9. MITRE ATT&CK, "Lateral Tool Transfer, Technique T1570 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1570/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/network-segmentation-vlan-micro-segmentation/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.