Network Segmentation with NIST: 6 Takeaways from NIST Guidelines

What Is Network Segmentation?

Network segmentation is the practice of dividing a computer network into smaller, distinct sub-networks. The main goal is to improve security by restricting lateral movement within the network. By segmenting networks, organizations can control and limit the spread of potential threats.

Segmentation can also improve network performance by reducing congestion through controlled traffic flow. Segmentation helps isolate sensitive data and critical functions from other network segments. This method minimizes the risk of unauthorized access.

Segmentation aligns with best practices for risk management and helps ensure compliance with regulations. By creating clear boundaries in a network, organizations can manage security risks more effectively.

These segmentation principles are also foundational to container security, where isolating workloads is critical to limiting the blast radius of a compromise.

What Is NIST?

The National Institute of Standards and Technology (NIST) is a U.S. federal agency that develops standards, guidelines, and best practices for various industries, including cybersecurity. Part of the U.S. Department of Commerce, NIST establishes security frameworks that organizations use to protect their systems and data.

One of its most well-known contributions is the NIST Cybersecurity Framework (NIST CSF), which provides a structured approach to managing and mitigating cyber risks. NIST also publishes the Special Publication (SP) 800 series, a collection of guidelines covering topics like network security, encryption, and access control.

Organizations worldwide reference NIST standards to strengthen their security posture and comply with regulatory requirements. By following NIST guidelines, organizations can implement strong security controls and improve their overall risk management strategies.

This is part of a series of articles about microsegmentation.

In this article:

NIST’s Perspective on Network Segmentation
Key Takeaways for Network Segmentation from NIST Guidelines

NIST’s Perspective on Network Segmentation

SP 800-215: Guide to a Secure Enterprise Network Landscape

NIST Special Publication (SP) 800-215 provides guidance on securing enterprise networks through strategies like network segmentation. It emphasizes the importance of limiting unauthorized access, reducing attack surfaces, and preventing lateral movement within a network.

The document highlights key segmentation techniques, including VLANs, firewalls, and software-defined networking (SDN). It also addresses best practices for implementing segmentation in hybrid and cloud environments, ensuring that security policies remain consistent across different network architectures.

By following SP 800-215 recommendations, organizations can design a segmented network that aligns with zero trust principles, improving security and regulatory compliance.

For a deeper look at how these approaches reinforce each other, see our guide to microsegmentation and zero trust.

SP 800-125B: Secure Virtual Network Configuration for Virtual Machine (VM) Protection

NIST SP 800-125B focuses on securing virtualized environments by configuring network segmentation for virtual machines (VMs). The publication outlines strategies for isolating VMs to prevent unauthorized communication and mitigate potential threats.

It discusses the use of virtual firewalls, microsegmentation, and network security policies to enforce isolation. Additionally, it highlights best practices for configuring virtual switches and hypervisors to reduce attack vectors within virtualized networks.

By applying the guidance in SP 800-125B, organizations can improve the security of their VM deployments, ensuring that virtual workloads remain protected from external and internal threats.

Tips from the Expert

In my experience, here are tips that can help you better implement NIST’s network segmentation guidelines:

Use identity-based segmentation:
Instead of relying solely on IP-based segmentation, leverage user and workload identities to enforce access controls dynamically. This approach aligns with zero trust and prevents reliance on static network rules.
Implement dynamic segmentation with automation:
Use orchestration tools to automatically adapt segmentation rules based on real-time network conditions, workload behavior, and threat intelligence.
Enforce least privilege at all layers:
Beyond network segmentation, apply least privilege principles to workloads, APIs, and microservices by integrating fine-grained RBAC and ABAC policies.
Leverage Kubernetes-native network policies:
If the infrastructure includes Kubernetes, take advantage of Kubernetes Network Policies to enforce east-west traffic segmentation, reducing unnecessary exposure between pods.
Segment cloud workloads across multiple VPCs:
When working in hybrid or multi-cloud environments, avoid flat networks and instead create separate Virtual Private Clouds (VPCs) for different workloads, applying cloud-native security groups for additional isolation.

Peter Kelly

VP of Engineering

Peter Kelly is Chief Technology Officer at Tigera and Site Leader for Tigera's EMEA office in Cork, Ireland. He is responsible for all of Tigera’s Engineering teams and operations. Peter has two decades of experience in software development, including recently building control plane technology for open-source proxies at NGINX and later F5 Networks, where he held engineering leadership positions. Peter has a degree in Computer Science and a Masters in Advanced Software Engineering.

Key Takeaways for Network Segmentation from NIST Guidelines

Here are a few key considerations to ensure your network segmentation implementation is in line with NIST guidelines.

1. Identify and Classify Assets

Before implementing network segmentation, organizations must conduct a thorough inventory of all assets within their network. This includes:

Hardware: Servers, endpoints, network devices (routers, switches, firewalls), and IoT devices.
Software: Applications, databases, and cloud-based services.
Data: Sensitive information such as personally identifiable information (PII), payment card data, intellectual property, and business-critical records.
User Roles: Employees, administrators, contractors, and third-party vendors with varying levels of access.

Each asset should be classified based on sensitivity, regulatory requirements, and business importance. For example, financial transaction systems should be categorized as high-risk assets, requiring stronger segmentation controls than general employee workstations.

Organizations should also map dependencies between assets to ensure segmentation does not disrupt operations. This includes identifying communication flows between applications, database access requirements, and interactions between on-premises and cloud environments.

2. Develop Security Zones

Security zones define boundaries between different parts of the network based on risk level, function, and access needs. Proper zoning ensures that high-value assets remain isolated from less secure areas.

Common security zones include:

Internal network: Contains core business systems and employee workstations. Access is restricted to authorized personnel only.
Production environment: Houses critical applications, databases, and customer-facing services. Requires strict segmentation from development and testing environments.
Guest and public zones: Includes guest Wi-Fi networks and public-facing web applications. These should be completely isolated from internal networks to prevent unauthorized access.
Administrative network: Dedicated for IT management activities, including remote access for administrators. This zone should have strict access controls to prevent privilege escalation attacks.
Regulated data zones: Special zones for handling sensitive data subject to compliance regulations, such as PCI DSS for payment data or HIPAA for healthcare information.

Each zone should have its own security policies, access controls, and monitoring mechanisms. Organizations should implement network access control (NAC) to verify devices before allowing them to connect to protected zones.

3. Implement Segmentation Techniques

Several network segmentation techniques help enforce security boundaries and improve traffic isolation:

VLANs (virtual local area networks): VLANs logically segment the network, restricting traffic between different groups of devices. For example, VLANs can separate employee workstations from IoT devices or finance department systems from general office networks. VLAN tagging (using IEEE 802.1Q) ensures that traffic remains isolated even if devices are connected to the same physical switch.
Overlay networks: These virtual networks operate on top of the existing infrastructure to provide additional segmentation. Examples include VPNs, SD-WANs, and VXLANs (virtual extensible LANs). Overlay networks are useful in multi-cloud and hybrid environments where traditional physical segmentation is difficult.
Microsegmentation: This approach applies granular security controls at the workload level, often using software-defined networking (SDN). Policies can be enforced based on application identity, user role, or device type. Microsegmentation is particularly effective in cloud environments and virtualized data centers, preventing lateral movement between virtual machines (VMs).

4. Enforce Traffic Control Measures

Once segmentation is in place, organizations must implement strict traffic control measures to regulate communication between network segments. Key traffic control mechanisms include:

Access control lists (ACLs): ACLs define which users, devices, or applications are allowed to communicate across segments. For example, a database server should only accept connections from authorized application servers, not from user workstations or the public internet.
Firewall policies: Firewalls enforce segmentation by blocking or allowing traffic based on predefined rules. Organizations should configure both perimeter firewalls (to restrict external access) and internal firewalls (to control east-west traffic within the network).
Zero trust network access (ZTNA): ZTNA ensures that no user or device is inherently trusted. Instead, all access requests are verified using identity-based authentication, least privilege principles, and continuous monitoring.
Deep packet inspection (DPI): This technique analyzes network traffic at the application level to detect malicious activity, unauthorized data transfers, or policy violations.

5. Establish Monitoring and Management Protocols

Continuous monitoring and centralized management are essential for maintaining a segmented network. Key strategies include:

Network traffic analysis: Security Information and Event Management (SIEM) solutions collect and analyze traffic patterns to detect anomalies, such as unauthorized lateral movement or unusual access attempts.
Log aggregation and correlation: Centralized logging solutions collect data from firewalls, intrusion detection systems (IDS), and endpoint security tools. Correlating these logs helps identify suspicious behavior and policy violations.
Automated incident response: Organizations should deploy automated response mechanisms that isolate compromised network segments in real time. For example, if a workstation is infected with malware, the system can automatically quarantine the device to prevent lateral spread.
Configuration management: Network segmentation policies should be regularly reviewed and updated as business needs evolve. Change management processes ensure that updates do not introduce security gaps or disrupt legitimate traffic.

Regular penetration testing and red teaming exercises help validate segmentation effectiveness by simulating real-world attack scenarios.

6. Plan for Scalability and Flexibility

As organizations grow, network segmentation strategies must adapt to accommodate new technologies, users, and services. Organizations should design segmentation policies with scalability and flexibility in mind by:

Supporting cloud and hybrid deployments: Many organizations operate across on-premises data centers and cloud environments. Segmentation strategies should extend to cloud-based workloads using virtual firewalls, cloud security groups, and identity-based policies.
Preparing for mergers and acquisitions: When companies merge or acquire new businesses, integrating network infrastructures without compromising security can be challenging. A modular segmentation approach ensures that new networks can be incorporated while maintaining strict access controls.
Implementing dynamic segmentation: Traditional segmentation methods often rely on static IP addresses and VLANs, which can be difficult to scale. Dynamic segmentation, using identity-aware policies and automated enforcement, allows organizations to adapt quickly to changes in network topology.
Addressing emerging threats: Cyber threats constantly evolve, and segmentation strategies must be updated to mitigate new risks. Organizations should regularly assess their segmentation model to ensure it remains effective against modern attack techniques, such as ransomware and advanced persistent threats (APTs).

Microsegmentation with Calico

Calico Enterprise and Calico Cloud provide a unified, cloud-native segmentation model and single policy framework that works across all of your existing environments—including hosts, VMs, containers, Kubernetes components, and services—while automatically scaling with your microservices environment.

Calico enables full workload portability and the ability to define segmentation policies for multi-cloud and hybrid connections. It is built for cloud scale and provides you with the ability to roll out security policy changes in milliseconds, while legacy segmentation tools take hours.

For a broader comparison of available solutions, see our overview of microsegmentation tools.

Key features and capabilities include:

Unified policy framework – Calico provides a single framework to define policies across all of your application and workload environments, including hosts, VMs, containers, and Kubernetes. This simplifies the process of creating host-level policies by providing visibility into traffic between HostEndpoints and determining the appropriate rules to accept or deny a connection.
Dynamic segmentation – Calico segments workloads based on metadata and labels attached to those workloads. This enables you to securely deploy new or updated workloads without having to add or change your segmentation policies.
Performance at scale – Calico utilizes a cloud-native, distributed architecture that can accept and enforce changes across hybrid and multi-cloud environments in milliseconds. This enables rapid auto-scaling of your microservices environment, and the ability to rapidly thwart security incidents by rolling out segmentation policy changes in response to an attack.
High-performance, distributed architecture for microsegmentation – Calico’s distributed cloud-native architecture eliminates centralized congestion points associated with legacy approaches to microsegmentation that can impact performance.

Next steps: