SC-7 / A.13.1.3 / CIS-12.2 NIST SP 800-53 Rev 5 CIS v8 ISO 27001 NIST CSF Network

Network segmentation between user and server tiers

Demonstrate that traffic between the user / workstation tier and the server / data tier is explicitly restricted, logged and reviewed — preventing lateral movement after a single endpoint compromise.

Description

What this control does

Network segmentation logically separates the user workstation tier from the server / data tier so that compromise of a single endpoint cannot grant direct lateral movement into critical infrastructure. Effective segmentation uses VLANs, host-based firewalls, identity-aware proxies and explicit east-west deny-by-default ACLs — not just perimeter firewalling. Modern deployments add micro-segmentation at the workload level, identity-bound access policies, and continuous monitoring of east-west traffic.

Control objective

What auditing this proves

Associated risks

Risks this control addresses

Ransomware encryptor reaches file servers via a compromised workstation
Lateral movement to domain controllers undetected
Data exfiltration from a server tier to the internet
Unauthorised admin tooling running across subnets
Insider with workstation access reaching production databases directly

Live threat patterns this control mitigates:

CRITICAL TA416 resumes European government espionage campaigns Since mid-2025, China-aligned threat actor TA416 has resumed targeting European government and diplomatic organizations after a two-year operational… CRITICAL China-based hackers-for-hire group staging espionage attacks alongside a cryptocurrency… Jewelbug is a China-based threat actor conducting dual operations: espionage campaigns targeting foreign governments and militaries, alongside a… CRITICAL Analysis of a Modular Cyber Espionage Framework Security researchers have uncovered a sophisticated cyber espionage operation deploying two previously undocumented malware families, OctLurk and SilkLurk,… CRITICAL NightLedger Backdoor Deployed in Espionage Campaign Targeting the Middle East and Africa An advanced persistent threat group, Mirage Kitten, is conducting cyber-espionage operations across the Middle East and Africa using… HIGH Mirage Kitten targets Middle East and Africa region with new malware Mirage Kitten, an advanced persistent threat group also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore, has been… CRITICAL Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days TA458, a Russia-aligned espionage group likely linked to GRU, continues exploiting half-click cross-site scripting vulnerabilities in webmail platforms… HIGH Westernint.com By eraleign (apt73) Western International Group is a large private conglomerate based in Dubai that operates in the r... MEDIUM Cybersecurity jobs available right now: June 30, 2026 AI Offensive Security Engineer AGAPI | UAE | On-site – View job details As an AI Offensive Security… MEDIUM Critical Vulnerability Disclosure New CVE or zero-day disclosure with active exploitation potential. Calls for emergency patch management, compensating controls (WAF, segmentation)… CRITICAL Ransomware Extortion Post Victim posted on a ransomware leak site after refusing or delaying ransom payment. Indicates an initial-access + privilege-escalation… HIGH Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns Geopolitical pressure drove much of the state-sponsored cyber activity recorded between October 2025 and March 2026, according to… HIGH Fast and Furious - Nimbus Manticore Operations During the Iranian Conflict The Iranian IRGC-affiliated threat actor Nimbus Manticore launched sophisticated cyber operations during Operation Epic Fury, the US military… HIGH Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns Unit 42 researchers identified six new remote access Trojan variants deployed by Iran-nexus APT group Screening Serpens between… CRITICAL Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers Between February and May 2026, over 1,350 active command-and-control servers were identified across 98 infrastructure providers spanning 14… CRITICAL ICS / OT Device Vulnerability Vulnerability disclosed in an industrial / building-control device. Implies the device may be reachable from the corporate network… CRITICAL Ransomware Incident Confirmed ransomware encryption + extortion event. Calls for the full playbook: MFA on remote access, immutable backups, EDR… HIGH OT / Industrial Control System Attack Attack targeting operational technology — pumps, controllers, processing equipment. Implies OT exposure to the internet, default credentials on…

Testing procedure

How an auditor verifies this control

Inventory: Document every VLAN, subnet and security group used to separate user vs server tiers. Capture the as-built diagram.
Configuration review: Inspect each firewall / NSG / ACL ruleset between user and server tiers. Confirm default policy is deny.
Allowed-flows test: Verify every documented exception (e.g. RDP from jump-host, AD replication, monitoring) is necessary, time-bound, and logged.
Live traffic test: From a representative user-tier endpoint, attempt to reach a server-tier service (SMB, SSH, RDP, internal HTTP) that should be blocked. Confirm denial + alert.
Lateral movement simulation: With red-team approval, attempt to traverse from a compromised user endpoint to the server tier using tools like CrackMapExec / impacket. Confirm detection and block.
Log review: Pull 30 days of east-west allow / deny logs. Confirm logging is enabled, retained, and reviewed.
Drift detection: Verify a process exists to detect + remediate unauthorised firewall-rule changes (CI/CD config, change-control records).

Evidence required Network diagram, firewall / NSG / ACL configuration exports, list of allowed east-west flows with business justification, deny-log samples, lateral-movement test report, change-control records for the last 90 days.

Pass criteria Deny-by-default policy enforced AND all allowed flows justified, logged, and reviewed within the last 90 days.

Where this control is tested

Audit programs including this control

Ransomware Incident — Control Review

Confirmed ransomware encryption + extortion event. Calls for the full playbook: MFA on remote access, immutable backups, EDR…

Remote Access and Credential Exposure Audit

Threat actors exploit weak VPN configurations and stolen or weakly protected credentials to gain initial access, then deploy…

ICS / OT Device Vulnerability — Control Review

Vulnerability disclosed in an industrial / building-control device. Implies the device may be reachable from the corporate network…