Tigera Logo

Guides: Microsegmentation

Microsegmentation in 2025: Importance, Types, and Best Practices

What Is Microsegmentation?

Microsegmentation is a cybersecurity technique that divides a network into small, isolated segments, often called microsegments, to enhance security and control access. It’s a more granular approach than traditional network segmentation and is often used to implement a zero-trust security model. By isolating workloads, applications, or even individual devices, microsegmentation limits the impact of potential breaches and prevents attackers from moving laterally across the network.

Microsegmentation was initially a way to moderate server-to-server traffic within a network segment, but has evolved to include traffic between segments. Modern microsegmentation can regulate if and how servers or applications in one network segment can communicate with those in another network segment. It is a key component of zero trust security strategies.

You can base microsegmentation policies and permissions on the identity of a resource, which makes it independent from the infrastructure. In comparison, network segmentation depends on IP addresses for the networks. Microsegmentation is thus a great way to create intelligent groupings of the workloads in your data center according to their characteristics.

Diagram showing microsegmentation in a Kubernetes cluster, with pods grouped based on identity, not IP addresses

With the massive adoption of containerized and cloud-native architectures, microsegmentation is changing. Traditional segmentation solutions cannot scale and do not effectively enforce security in a containerized environment, such as a Kubernetes cluster. New microsegmentation technologies are emerging that can discover endpoints in cloud-native environments, define policies, and apply policies dynamically to constantly changing cloud-native networks.

This makes microsegmentation a foundational element of modern container security, where ephemeral workloads require identity-based controls rather than static IP rules.

This is part of an extensive series of guides about network security.

In this article:

Microsegmentation Importance and Benefits

Traditionally, companies defended their network perimeter with a variety of security tools deployed at the network edge (primarily the firewall). The main focus was on screening north-south traffic between the network and external traffic sources. These tools were like the moat protecting a castle, and inhabitants inside the “castle” (the network perimeter) were inherently trusted.

With the advent of the cloud and trends like bring your own device (BYOD), things have become a lot more complex. There has been major growth in east-west traffic, within the data center, and between distributed systems. It is becoming increasingly difficult to defend the perimeter, and there is a need to create multiple micro-perimeters around each valuable asset the organization needs to protect.

This is where microsegmentation comes in. It allows network administrators to create secure “islands” within their distributed infrastructure and control access to those islands for all types of users, whether they are outsiders, customers, or employees logging in from a variety of locations.

Microsegmentation is central to implementing a zero trust security model. Specifically, it is a core component of zero trust network access (ZTNA) solutions. With microsegmentation, network segments can be protected with a handful of consistent identity policies, rather than hundreds of unwieldy IP-based rules.

Benefits of microsegmentation include:

  • Enhanced security: Limits the impact of breaches and prevents lateral movement.
  • Improved compliance: Helps organizations meet regulatory requirements for data protection and access control.
  • Reduced risk: Minimizes the potential damage from attacks and insider threats.
  • Simplified management: Modern solutions automate many aspects of microsegmentation, simplifying management in complex environments.
  • Flexibility and scalability: SDN and virtualization enable microsegmentation to adapt to changing network needs and scale as the organization grows.

Microsegmentation Concepts

Let’s review some of the key concepts behind microsegmentation:

  • Granular isolation: Microsegmentation creates small, isolated security zones, often at the level of individual applications, workloads, or even devices.
  • Reduced attack surface: By limiting the scope of each segment, microsegmentation reduces the potential impact of a security breach.
  • Lateral movement prevention: It prevents attackers from moving freely across the network once they gain access to one segment.
  • Principle of least privilege: Microsegmentation allows organizations to enforce the principle of least privilege, granting access only to what is necessary for each segment.
  • Zero trust foundation: It’s a key component of a zero-trust security model, where every user and device is treated as untrusted until proven otherwise.

Here is a brief overview of how microsegmentation works:

  • Dynamic segmentation: Microsegmentation often uses software-defined networking (SDN) and virtualization to dynamically create and adjust security boundaries.
  • Fine-grained access control: It enables precise control over traffic flow, allowing only authorized communication between segments.
  • Real-time monitoring: Modern microsegmentation solutions often include real-time monitoring and analysis to detect and respond to threats.

Microsegmentation vs. Traditional Network Segmentation

Network segmentation uses infrastructure-level boundaries like subnets, VLANs, and firewalls to divide networks into isolated zones. Each zone can have its own security rules, which helps limit the attack surface. However, these rules are often based on IP addresses and ports, making them static and prone to misconfiguration as environments evolve.

Microsegmentation enforces policies at the workload level. Policies can be defined based on attributes such as application identity, user roles, or tags. This makes them more granular and adaptable, especially in dynamic environments such as containers or hybrid clouds. Microsegmentation policies follow workloads wherever they move, ensuring consistent enforcement regardless of underlying infrastructure.

Another key difference is in traffic visibility. Network segmentation typically focuses on controlling north-south traffic and may miss lateral movement by attackers within the network. Microsegmentation provides deep visibility and control over east-west traffic, making it better suited to detecting and preventing internal threats.

Frameworks like NIST guidance on network segmentation outline how to apply these principles in regulated environments.

Drawbacks of Traditional Network Segmentation

Traditional network segmentation involves dividing a network into smaller segments, called subnets, with each one becoming its own isolated network. This makes it possible for administrators to manage how traffic flows between the subnets.

Traditional segmentation protects networks by allowing administrators to set up separate policies for each subnet—treating each subnet as a separate attack surface and making it easier to detect and respond to threats.

With traditional network segmentation, an organization uses tools like:

  • Firewalls – Filters inbound and outbound traffic for each subnet.
  • Intrusion prevention systems (IPS) – Continuously monitors traffic and blocks traffic indicating an attack.
  • Virtual local-area networks (VLANs) – Divides a local-area network (LAN) into smaller segments with greater control over each segment.

Network segmentation focuses on protecting north-south traffic from end-users or clients to on-premises environments. It examines data flowing into the network to protect it from external threats.

The main limitation of network segmentation is that it does not examine activities occurring inside the network and can miss insider threats. Microsegmentation enables organizations to apply security protocols to traffic existing within the network, moving east-west between internal servers.

Microsegmentation: The Evolution of Cybersecurity

Microsegmentation provides several important benefits compared to traditional network segmentation:

  • Reduced attack surface – Once the network is segmented, the organization can focus security policies and processes around individual users to limit the eventuality and scope of lateral movement.
  • Granular policies for extended visibility and control – Another key advantage is the ability to refine policies for certain devices and locations and account for the security context of each network connection.
  • Defense in depth – Microsegmentation can help improve threat detection and response times during a security breach event. Microsegmentation tools can determine when policy violations occur and push real-time alerts to relevant stakeholders. Some tools can also block unauthorized activities automatically.
  • Compliance – Microsegmentation enables organizations to create compliance-focused policies for specific networks—for example, networks that handle protected health information (PHI) or personally identifiable information (PII). These policies are particularly useful for simplifying auditing processes and can help organizations comply with regulatory laws.

Types of Microsegmentation

Application Segmentation

This type of microsegmentation ring-fences applications to protect sensitive communication. This includes controlling traffic between applications (whether they run on containerized workloads, hypervisors, or bare metal) in proprietary data centers and public or hybrid cloud environments.

High-value applications that provide critical services, contain sensitive or personal data, or are subject to regulations (such as HIPAA, SOX, or PCI DSS), must be protected. Organizations can leverage application segmentation to improve their application security and maintain compliance.

For example, organizations subject to payment-card requirements often use network segmentation for PCI DSS to isolate cardholder data environments from the rest of the network.

Environmental Segmentation

In a traditional network, assets are dynamically placed throughout the development, staging, testing, and production environments, and across public or hybrid clouds, making it difficult to control and protect them. Environmental microsegmentation isolates various deployment environments from each other, restricting their communication.

Application Tier-Level Segmentation

It is common for an N-tiered application to have application, web, and database tiers, which might need to be protected from each other through segmentation. Microsegmentation at the application tier level prevents unauthorized lateral movement between workloads by dividing them based on roles.

A segmentation policy could, for example, permit the processing tier to communicate with the database tier but not with the web or load balancer tier. This helps reduce the attack surface.

Process-Based Nano-Segmentation

You can achieve a higher level of granularity in your segmentation by reducing the attack surface into smaller units. This means you treat each virtual machine (VM) or bare metal server as an individual unit. You can implement this for on-premises data centers as well as cloud environments.

To implement process-based nano-segmentation, you need to dynamically program precise outbound and inbound security rules for each workload. The platform can then create an adaptive perimeter designed around each computing instance, which creates a segment of one.

You can define permitted workload interactions for your applications without network dependencies, by combining process-based nano-segmentation with an allowed policy model. You can then further drill down your segments. For example, you can separate two instances of one process that runs on the same machine into two isolated segments.

Virtualization platforms such as VMware NSX provide hypervisor-level enforcement that supports microsegmentation in VMware environments.

User Segmentation

User segmentation limits application visibility to members of specified groups, using identity services like Microsoft Active Directory. Group membership and user identity form the basis of user segmentation, so there is no need to make changes to the infrastructure. With user segmentation, each user in your VLAN might have a different policy providing different access permissions.

User segmentation often complements NAC in cyber security, which enforces device and user authentication before granting network access.

Container Segmentation

Containers might hold sensitive data or critical business information, and are often deployed as microservices within a Kubernetes cluster. If the containers are not segmented, sensitive information may be exposed to anyone with access to the network.

Kubernetes Segmentation

Kubernetes allows you to use network policies when implementing network segmentation. You can use network enforcement capabilities provided natively in Kubernetes, or infrastructure layers like service meshes.

The default settings in Kubernetes do not restrict communication between containers, pods, and nodes; these components can communicate between namespaces or within the same namespace. You can use network policies to restrict this communication, starting with adding a policy that denies all communication, and then specifying what communication is allowed.

Kubernetes pods need to communicate with each other. When defining network policies, you should systematically list all the pods each given pod must communicate with. You should also define a list of allowed and restricted ingress and egress public internet communication.

For a deeper look at implementing Kubernetes microsegmentation with policy-driven enforcement, see how Calico applies identity-based controls to pods and namespaces.

Key Microsegmentation Use Cases

Development and Production Systems

Microsegmentation is highly effective in isolating development, staging, and production environments. It prevents accidental or unauthorized communication between systems at different stages of the software lifecycle. For example, developers should not have access to production databases, and staging services should not be able to communicate with live customer data.

By applying granular policies that define which workloads can interact—and under what conditions—organizations can minimize the risk of configuration errors and data leaks. This level of control also supports compliance efforts, particularly in environments subject to audit requirements.

Cloud Migration

During cloud migration, workloads often straddle on-premises and cloud environments. Microsegmentation can enforce consistent security policies across hybrid infrastructure, allowing organizations to manage risk while transitioning to the cloud.

By tagging workloads and defining communication rules based on identity rather than IP addresses, security teams can maintain a consistent posture before, during, and after migration. This helps reduce attack surfaces and makes it easier to validate that only necessary traffic flows between cloud and on-prem components.

Virtual Desktop Infrastructure

Virtual desktop infrastructure (VDI) environments are especially vulnerable to lateral movement due to the high number of users and endpoints sharing the same infrastructure. Microsegmentation helps secure VDI by creating isolated environments for each desktop or user group, limiting access only to necessary resources.

This containment ensures that if one virtual desktop is compromised, the threat cannot easily spread to others or to backend services. It also supports secure remote work scenarios by defining fine-grained access rules for remote sessions based on user roles or device posture.

Incident Response

In incident response scenarios, microsegmentation allows teams to quickly isolate compromised workloads and prevent further damage. By dynamically adjusting segmentation policies, security teams can quarantine affected systems in real-time without disrupting unrelated parts of the network.

Microsegmentation also aids forensic investigations by offering detailed visibility into traffic flows, helping analysts trace attacker movement and identify initial entry points. Once containment is achieved, policies can be updated to prevent similar incidents in the future.

How Does Microsegmentation Promote a Zero Trust Security Strategy?

When implementing a zero trust security model, microsegmentation is a key building block. Here are some of the benefits microsegmentation can offer to an organization implementing zero trust.

Integrating Security into Workloads

A zero trust architecture requires that security be embedded into workloads themselves, rather than only existing at the network level. This ensures that if a workload moves between environments—for example, a virtual machine moves from an on-premise data center to the cloud—or if additional instances of a workload are created, they will retain the same security properties.

Microsegmentation can help achieve this because it is sensitive to the specific devices or hosts requesting access to resources. By achieving robust device and service identities, microsegmentation can recognize that an instance belongs to a known workload, and apply the policies appropriate to that workload—whether the request came from the first or the hundredth instance of that workload.

Supporting Automated and Dynamic Environments

In a zero trust environment, networks and environments are fully automated and can be replicated or torn down at will. This makes it impossible to rely on fixed network enforcement points. Microsegmentation can help define dynamic network segments that apply the correct security policies in every environment.

Technically, this can leverage a hypervisor backplane that facilitates all communication in a cloud environment, or a virtualized network switch. Microsegmentation can integrate with this infrastructure, intercept all connection requests, and dynamically apply security policies.

Together, microsegmentation zero trust approaches enable consistent enforcement across dynamic, automated environments.

Preventing Lateral Movement

Microsegmentation allows administrators to set affinity policies, which define which type of traffic should be allowed for which systems and applications. When threats attempt to move laterally within the environment, these affinity policies can detect and block them, because their security context will not be compatible with the sensitive assets they are trying to access.

For example, if a web server is allowed to communicate with a database, and an attacker compromised the web server, they would not get unlimited access to the database. They would only be able to send the typical types of requests a web server would, and any anomalous access would be detected and blocked. This severely limits the damage that can be caused by an attacker and the “blast radius” of a successful attack.

Read our blog: The New Model for Network Security: Zero Trust

7 Best Practices for Successful Microsegmentation

To implement microsegmentation in your organization, you need to design an architecture that suits your security and productivity needs, and implement it gradually to avoid disrupting normal network operations.

Choosing the right microsegmentation software is a critical step, since the platform determines how policies are defined, enforced, and monitored across your environment.

Design Best Practices

1. Define Your Boundaries

Microsegmentation is most effective when it uses well-defined boundaries. Define the objectives of your applications according to your business needs and the categorization or identification of end users. This allows you to identify the desired boundaries for your applications, which determine the type of information that can be exchanged.

2. Use an Application-Centric Approach

The next step is to create the boundaries for each application. Establish context-based visibility for each application and define any internal or external communication required. Identify the users that need to access the application, as well as the specific data or application services they require.

3. Define Levels of Access

Applications often have tiers for services that are relevant to a particular group of users. Use a least-privilege approach, starting with the lowest privilege level and applying additional privileges for each user group and service.

Implementation Best Practices

4. Use a Crawl-Walk-Run Implementation Model

Once you have identified the infrastructure assets that need to be protected, you must group these assets according to logical definitions. Structure your implementation to first select a group of assets (such as applications, datasets, servers, or users) and then define their implementation process. Evaluate the methodologies and verification process to strengthen and enforce the implementation process.

5. Label Assets for Security

Identify assets and attribute them to enable effective policies. Applications and components should be labeled and grouped accordingly. Create policies based on labels and application visibility.

6. Author and Configure Policies

You can author and configure policies to enhance your visibility into the communications between assets such as servers and applications. This granular level of visibility allows you to customize your microsegmentation policies according to your business requirements.

7. Simulate and Validate Applications

The best way to ensure your security policies are effective is to test them using simulations. This allows you to identify and address gaps in the implementation policy.

Microsegmentation with Calico

Calico Enterprise and Calico Cloud provide a unified, cloud-native segmentation model and single policy framework that works across all of your existing environments—including hosts, VMs, containers, Kubernetes components, and services—while automatically scaling with your microservices environment.

Calico enables full workload portability and the ability to define segmentation policies for multi-cloud and hybrid connections. It is built for cloud scale and provides you with the ability to roll out security policy changes in milliseconds, while legacy segmentation tools take hours.

Key features and capabilities include:

  • Unified policy framework – Calico provides a single framework to define policies across all of your application and workload environments, including hosts, VMs, containers, and Kubernetes. This simplifies the process of creating host-level policies by providing visibility into traffic between HostEndpoints and determining the appropriate rules to accept or deny a connection.
  • Dynamic segmentation – Calico segments workloads based on metadata and labels attached to those workloads. This enables you to securely deploy new or updated workloads without having to add or change your segmentation policies.
  • Performance at scale – Calico utilizes a cloud-native, distributed architecture that can accept and enforce changes across hybrid and multi-cloud environments in milliseconds. This enables rapid auto-scaling of your microservices environment, and the ability to rapidly thwart security incidents by rolling out segmentation policy changes in response to an attack.
  • High-performance, distributed architecture for microsegmentation – Calico’s distributed cloud-native architecture eliminates centralized congestion points associated with legacy approaches to microsegmentation that can impact performance.

Next steps:

See Additional Guides on Key Network Security Topics

Together with our content partners, we have authored in-depth guides on several other topics that can also be useful as you explore the world of network security.

SIEM

Authored by Exabeam

Incident Response

Authored by BlueVoyant

AWS Security

Authored by NetApp

X