Cyberpediaby Brain
ENDEFR

Network segmentation and VLANs against ransomware

Splitting a network into zones (VLANs, internal firewalls, micro-segmentation) limits ransomware. What employees do to make it hold.

In 30 seconds

Where it happens
On the company's internal network, once a workstation or an account is compromised.
What the attacker wants
To move from one machine to others to encrypt as much data as possible1.
If it has already happened
Tell IT or security right away, and they will isolate the workstation; if asked, unplug the cable or turn off Wi-Fi2.
The reflex
Do not plug in any unauthorized device or media, stay on the network intended for your use, and quickly report a workstation that behaves oddly so that it can be isolated.

What it is

Ransomware rarely stops at the first computer it hits. According to MITRE ATT&CK, encryption software can spread through a network, worm-like, to encrypt the data of a large number of machines and maximize damage1. Splitting the network into sealed zones is one of the responses to this risk.

This page explains what the terms VLAN, internal firewall and micro-segmentation cover, what an employee can do to make this split hold, and the pitfalls that make it ineffective.

Straight answers

What is network segmentation?

It is the splitting of a network into smaller, isolated segments, to control traffic between devices, systems and applications. MITRE ATT&CK states that this reduces the attack surface, slows the attacker's movements and protects critical assets3.

What are a VLAN and an internal firewall?

MITRE ATT&CK describes a separation made of physical boundaries, logical separation by VLAN and access rules enforced by equipment such as firewalls and routers3. A VLAN is therefore a logical separation, and the internal firewall controls what passes from one segment to another.

And micro-segmentation?

It is the same principle at the scale of each workload. MITRE ATT&CK recommends software-defined networking tools to segment at that level and prevent lateral movement3.

Why does this concern an employee?

Because segmentation can be bypassed by a user error. CISA specifies that it can become ineffective when the organization's rules are not followed, for example by connecting removable media or other devices to several segments2.

1How it works1 min

The principle is to group systems by function, sensitivity and risk. MITRE ATT&CK gives payment systems, HR databases, production systems and Internet-facing servers as examples3. Web, DNS and mail servers reachable from outside are placed in a demilitarized zone (DMZ), with strict filtering rules toward the internal network3.

The rules follow a deny-by-default logic: access control lists on network equipment, and firewalls that limit both traffic between outside and inside and traffic between internal machines3. MITRE ATT&CK also recommends separating Wi-Fi and wired networks, notably when the wired network gives access to sensitive resources3.

CISA recommends separating the organization's services or departments and keeping a separation between conventional IT and industrial systems. Its guide presents a diagram of a "flat" (unsegmented) network and a diagram of a segmented network2.

The British NCSC goes further with "zero trust": the trust inherent in the network is removed, the network is considered hostile and each request is verified against an access policy4. For NIST, this approach shifts defense from static perimeters to users, assets and resources5. NIST says that zero trust protects resources, not network segments5.

2What you do1 min
  • Do not plug in unauthorized devices, either into a network socket or into a workstation. CISA cites connecting removable media or devices to several segments as a cause of segmentation failure2.
  • Use the network intended for your use. MITRE ATT&CK recommends separating Wi-Fi and wired environments when the latter gives access to sensitive resources3.
  • Quickly report a suspicious workstation to IT or security, who isolate the affected systems in a coordinated way. If asked, unplug the network cable or turn off Wi-Fi: CISA presents unplugging devices as a fallback when taking them offline is not immediately possible2.
  • Do not power off on your own without instructions. CISA states that cutting power loses traces in memory and is done only if disconnection is impossible otherwise2.
3Pitfalls2 min

The flat network. When everything talks to everything, a single compromised workstation opens access to the rest. MITRE ATT&CK notes that with valid domain credentials, an attacker can connect to many machines through remote access protocols such as SSH or RDP6.

A VLAN without filtering. Separating is not enough if nothing controls what passes. MITRE ATT&CK asks for firewall rules that block RDP traffic between security zones and for deny-by-default on access control lists3. It also recommends regularly reviewing the rules, monitoring traffic flows and testing segmentation with periodic penetration tests3.

Rules that are too broad. MITRE ATT&CK recommends allowing only the necessary ports and traffic3. A rule that lets everything through removes the point of the zone.

Unsegregated administration. The hidden Windows administrative shares (C$, ADMIN$, IPC$) allow remote file copying and other administrative functions, and an attacker can use them with a valid administrator account7. For WinRM, MITRE ATT&CK advises isolating critical enclaves with separate infrastructure and restricting access to specific devices3.

Vulnerable servers reachable from everywhere. Known flaws exist in common services such as SMB and RDP, as well as in internal applications such as MySQL8. MITRE ATT&CK recommends segmenting to reduce access to critical systems to controlled methods3.

Tool copies from one machine to another. An attacker can copy files between internal systems with sharing protocols such as SMB or an authenticated RDP connection9.

4Real cases1 min

2016: attack on the Ukrainian power grid

According to MITRE ATT&CK, during the 2016 attack on the Ukrainian power grid, the Sandworm Team group used the net use command to connect to network shares7. The sources cited here give no further detail on this episode.

The APT28 "Nearest Neighbor" campaign

MITRE ATT&CK states that, during the "Nearest Neighbor" campaign, APT28 used SMB to transfer files and move laterally7. The sources cited here give no date for this campaign.

Fact sheet

Identifier
CP-228
Wing
3. Protocols and defence
Brain skill
Safe Web Browsing (browse_safely)
Brain reflex
cr-079
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
9 sources checked on 3 November 2026
Sources9 sources
  1. MITRE ATT&CK, “Data Encrypted for Impact, Technique T1486 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1486/ (accessed 3 November 2026)
  2. CISA, “#StopRansomware Guide | CISA”. https://www.cisa.gov/stopransomware/ransomware-guide (accessed 3 November 2026)
  3. MITRE ATT&CK, “Network Segmentation, Mitigation M1030 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/mitigations/M1030/ (accessed 3 November 2026)
  4. NCSC (UK), “Zero trust architecture design principles”. https://www.ncsc.gov.uk/collection/zero-trust/architecture-design-principles (accessed 3 November 2026)
  5. NIST, “SP 800-207, Zero Trust Architecture | CSRC”. https://csrc.nist.gov/pubs/sp/800/207/final (accessed 3 November 2026)
  6. MITRE ATT&CK, “Remote Services, Technique T1021 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1021/ (accessed 3 November 2026)
  7. MITRE ATT&CK, “Remote Services: SMB/Windows Admin Shares, Sub-technique T1021.002 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1021/002/ (accessed 3 November 2026)
  8. MITRE ATT&CK, “Exploitation of Remote Services, Technique T1210 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1210/ (accessed 3 November 2026)
  9. MITRE ATT&CK, “Lateral Tool Transfer, Technique T1570 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1570/ (accessed 3 November 2026)

Cite this article

Brain, “Network segmentation and VLANs against ransomware”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/network-segmentation-vlan-micro-segmentation/

BibTeX 
@misc{brain_cp228_en_2026,
  author = {Brain},
  title = {Network segmentation and VLANs against ransomware},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/network-segmentation-vlan-micro-segmentation/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence