/network-segmentation-review

name: network-segmentation-review
description: >-
  Review network segmentation and firewall/ACL design for security: zone
  separation, ruleset hygiene, lateral-movement containment, and zero-trust /
  microsegmentation. Use to assess or design network architecture defensively (not
  active testing).

Goal

An assessment of how well the network limits blast radius: are zones separated, are firewall rules least-privilege, and is lateral movement contained — with prioritized fixes.

What to review

1. **Zoning & trust** — segmentation between internet/DMZ/internal/management/OT, per-environment (prod/dev) and per-tenant separation; where trust changes. 2. **Firewall / ACL hygiene** — overly broad rules (`any/any`), unused/shadowed rules, stale entries, missing egress filtering, default-allow. 3. **Lateral-movement containment** — is the internal network flat? Can one compromised host reach the whole estate? East-west controls, microsegmentation. 4. **Management & sensitive planes** — isolated management network, jump hosts, restricted access to admin interfaces, OT/ICS separation. 5. **Zero-trust posture** — identity-aware access vs. pure network location; explicit allow-listing.

Steps

1. Gather topology, firewall rulesets/ACLs, and zone definitions. 2. Assess against the areas above; flag broad/stale rules and flat segments. 3. Model the lateral-movement blast radius from a typical foothold. 4. Recommend segmentation, rule tightening (least privilege, default-deny egress), and management isolation, prioritized by blast-radius reduction.

Output

A review: zone/rule · issue · severity · fix, plus a target segmentation design and egress policy. Visualize zones with `security-diagramming:architecture-diagram`; report with `security-reporting`.

Notes

Flat networks are the force-multiplier behind most breaches — containing east-west movement limits blast radius more than almost any other network control. Hunt broad (`any/any`) and stale firewall rules; default-deny egress is commonly missing and high-value. Pairs with `network-pentest` (which demonstrates the lateral paths).