Network segmentation is the division of a larger computer network into smaller, controlled subnetworks or segments. It is used primarily to improve security, performance, manageability, and fault containment by controlling communication between devices.
How network segmentation works
Each segment contains a defined group of devices, such as student computers, staff computers, or servers. Segmentation can be physical, using separate networking hardware, or logical, using technologies such as subnets and virtual local area networks (VLANs).
Devices within a segment can usually communicate directly. Data moving between segments passes through a routing device, such as a router or Layer 3 switch. Access control rules or firewalls can then inspect, permit, or block this traffic.
For example, a school could place student devices, staff devices, and database servers in separate VLANs. Students may be permitted to access a learning platform but blocked from connecting directly to the staff or database segment.
| Purpose | How segmentation helps |
|---|---|
| Security | Restricts unauthorized access and limits an attacker's movement between systems. |
| Performance | Reduces unnecessary traffic and limits the size of broadcast domains. |
| Fault containment | Prevents some failures, malware infections, or traffic surges from affecting the whole network. |
| Management | Allows different policies and permissions to be applied to different groups of devices. |
| Monitoring | Makes suspicious traffic easier to identify because communication between segments passes through controlled points. |
A common misconception is that segmentation automatically makes a network secure. It only creates boundaries; those boundaries must be supported by correctly configured firewall rules, access controls, monitoring, and secure authentication.
IB exam technique
For an A2.2 network architecture question, first define segmentation, then explain its mechanism and link each use to a consequence. For example: placing servers in a separate VLAN allows a firewall to restrict incoming traffic, thereby reducing unauthorized access. Avoid simply listing “security” and “performance” without explaining how segmentation produces those benefits.
