SC-7 / A.13.1.3 / CIS-12.2 NIST SP 800-53 Rev 5 CIS v8 ISO 27001 NIST CSF Network

Network segmentation between user and server tiers

Demonstrate that traffic between the user / workstation tier and the server / data tier is explicitly restricted, logged and reviewed — preventing lateral movement after a single endpoint compromise.

Description

What this control does

Network segmentation logically separates the user workstation tier from the server / data tier so that compromise of a single endpoint cannot grant direct lateral movement into critical infrastructure. Effective segmentation uses VLANs, host-based firewalls, identity-aware proxies and explicit east-west deny-by-default ACLs — not just perimeter firewalling. Modern deployments add micro-segmentation at the workload level, identity-bound access policies, and continuous monitoring of east-west traffic.

Control objective

What auditing this proves

Associated risks

Risks this control addresses

Ransomware encryptor reaches file servers via a compromised workstation
Lateral movement to domain controllers undetected
Data exfiltration from a server tier to the internet
Unauthorised admin tooling running across subnets
Insider with workstation access reaching production databases directly

Live threat patterns this control mitigates:

HIGH ICS / OT Device Vulnerability Vulnerability disclosed in an industrial / building-control device. Implies the device may be reachable from the corporate network… MEDIUM Ransomware Incident Confirmed ransomware encryption + extortion event. Calls for the full playbook: MFA on remote access, immutable backups, EDR… HIGH OT / Industrial Control System Attack Attack targeting operational technology — pumps, controllers, processing equipment. Implies OT exposure to the internet, default credentials on…

Testing procedure

How an auditor verifies this control

Inventory: Document every VLAN, subnet and security group used to separate user vs server tiers. Capture the as-built diagram.
Configuration review: Inspect each firewall / NSG / ACL ruleset between user and server tiers. Confirm default policy is deny.
Allowed-flows test: Verify every documented exception (e.g. RDP from jump-host, AD replication, monitoring) is necessary, time-bound, and logged.
Live traffic test: From a representative user-tier endpoint, attempt to reach a server-tier service (SMB, SSH, RDP, internal HTTP) that should be blocked. Confirm denial + alert.
Lateral movement simulation: With red-team approval, attempt to traverse from a compromised user endpoint to the server tier using tools like CrackMapExec / impacket. Confirm detection and block.
Log review: Pull 30 days of east-west allow / deny logs. Confirm logging is enabled, retained, and reviewed.
Drift detection: Verify a process exists to detect + remediate unauthorised firewall-rule changes (CI/CD config, change-control records).

Evidence required Network diagram, firewall / NSG / ACL configuration exports, list of allowed east-west flows with business justification, deny-log samples, lateral-movement test report, change-control records for the last 90 days.

Pass criteria Deny-by-default policy enforced AND all allowed flows justified, logged, and reviewed within the last 90 days.

Where this control is tested

Audit programs including this control

Ransomware Incident — Audit Program

Confirmed ransomware encryption + extortion event. Calls for the full playbook: MFA on remote access, immutable backups, EDR…

Remote Access and Credential Exposure Audit

Threat actors exploit weak VPN configurations and stolen or weakly protected credentials to gain initial access, then deploy…

ICS / OT Device Vulnerability — Audit Program

Vulnerability disclosed in an industrial / building-control device. Implies the device may be reachable from the corporate network…