How to segment an internal network to contain lateral movement and ransomware

In 2025 eCrime groups needed, on average, 29 minutes to get from the first compromised machine to another system on the network, and the fastest managed it in 27 seconds, according to CrowdStrike's 2026 Global Threat Report.

On a flat internal network that jump meets little resistance. A finance clerk's laptop can reach the file server, the domain controller and the backup console over the same ports the IT team uses to manage them. Many organisations have hardened the perimeter, rolled out EDR and enforced multi-factor authentication, yet left the inside of the network much as it was on installation day, with every machine able to see every other. Network segmentation is the control that closes those paths.

Why does a flat network help ransomware spread?

Incident response data tells the same story. Sophos's 2026 Active Adversary Report, built on 661 incident response and managed detection cases, found internal use of RDP in 66% of them. The most common tool was Impacket, a Python toolkit for working with Windows protocols such as SMB, which made up 36% of all tools identified. And attackers went after Active Directory 70% faster than the year before, reaching a median of 3.4 hours from initial access.

None of that movement needs a clever exploit. Remote desktop, Windows file sharing and remote management are legitimate services the network lets through because administrators rely on them every day, and attackers use them for lateral movement precisely because they blend in.

Microsoft's figures show why endpoint protection cannot carry the load alone. Its Digital Defense Report 2024 found that in over 90% of ransomware attacks that reached the ransom stage, the attacker used unmanaged devices, either as the way in or to encrypt remotely. Remote encryption means running the encryptor on a machine with no security agent and attacking the servers' file shares over the network. The server's EDR sees file writes arriving from a valid session. What can stop the operation is a network that does not let the unmanaged machine reach those shares.

Attackers are also handing over access faster. Mandiant's M-Trends 2026 reports that the hand-off between the group that gains initial access and the group that exploits it dropped from more than eight hours in 2022 to a median of 22 seconds in 2025. At that pace containment has to be designed in advance. A network rule that already exists works at second zero, whereas an alert depends on someone, or something, reacting in time.

Backups are the other usual target. In a Sophos survey published in 2024, 94% of organisations hit by ransomware said attackers had tried to compromise their backups, and 57% of those attempts succeeded. A backup console that any workstation can reach will end up on the attacker's list.

Macro-segmentation, microsegmentation and the unfiltered VLAN

CISA's microsegmentation guidance, published in July 2025, separates two levels. Macro-segmentation splits the network into large blocks that follow business needs: users, servers, guests, the shop floor. Microsegmentation shrinks the zones around the communication needs of individual applications and data flows, with finer rules that can take the context of each connection into account. Both belong in a zero trust model.

Plenty of networks are considered segmented simply because they have VLANs. A VLAN separates traffic at the data link layer, but if the router or firewall joining the VLANs allows any connection between them, an attacker crosses from one to another as easily as before. The protection lives in the rule at the interconnection point. Spain's National Security Framework (ENS) makes the same point by requiring, at its high category, that this point control what enters and leaves each segment.

Nor does microsegmentation have to begin with a platform purchase. The firewall built into every Windows machine can refuse inbound connections from other workstations and, managed centrally, covers much of the traffic ransomware relies on to spread.

What to separate first in a corporate network

The UK NCSC's guidance on preventing lateral movement frames it as identifying, grouping and isolating critical business systems, then applying suitable network controls to them. A sensible order, highest impact first:

1. Administration. Systems are managed from a dedicated network or segment, through admin workstations and jump servers, and management protocols are accepted only from there. The Active Directory tiering model rests on the same idea.
2. Domain controllers and the rest of Tier 0. They should accept only the authentication and replication traffic they need, plus administration from the zone above.
3. Backup infrastructure, with its console, repositories and service accounts placed in a zone that user workstations cannot reach.
4. Traffic between user workstations, usually the most cost-effective change and covered in the next section.
5. Supplier and third-party access, in a zone of its own that reaches only the systems under contract.
6. Development and test environments, kept apart from production and away from its data.
7. Anything that cannot run an agent: printers, cameras, building controllers and industrial equipment. Where EDR cannot be installed, the network is the main control left, as we set out when looking at EDR blind spots. For plant environments, our piece on OT/IT risk prioritisation goes further.

Which connections should workstations refuse?

Human-operated ransomware moves mainly over four families of Windows protocols: SMB for files and remote execution, RDP for remote desktop, WinRM for remote PowerShell, and RPC with WMI for management. Between a jump server and a server, that traffic is normal. Between two user workstations it almost never is, and in most organisations a laptop seldom needs to accept SMB or RDP connections from another laptop.

One of the most cost-effective measures is a host firewall policy, pushed through Group Policy or the device management tool, that makes workstations refuse inbound connections over those protocols unless they come from the admin segment. CISA's #StopRansomware guide recommends blocking internal SMB traffic between systems that do not need it and, where lateral SMB is unavoidable, requiring Kerberos-based IPsec. Retiring legacy authentication helps as well: switching off NTLM takes away a common way of reusing stolen credentials.

Servers follow similar logic. A file server accepts SMB from users but has no reason to accept RDP from them, and remote desktop to servers should arrive only from jump servers. An application server exposes its service port and little else, and any exception is recorded along with its business reason.

How to plan segmentation without breaking the business

Any infrastructure lead's first worry is breaking an application that depends on a connection nobody documented. CISA suggests a four-phase cycle, repeated block by block: identify candidate resources, map their dependencies, define the policies, then deploy them with testing and monitoring.

Much of the dependency map comes from telemetry the organisation already generates. Internal firewall logs, network flow records, EDR connection events or an NDR sensor show which machine connects to which, and on which port. If those sources are not reaching the SIEM today, our guide on which logs to send to a SIEM helps decide the order.

New rules go through a trial phase first: log-only mode where the platform supports it, as many network firewalls and microsegmentation tools do, or a pilot group of machines with dropped-connection logging switched on if the Windows firewall is doing the work. The team fixes the legitimate exceptions during that period and only then rolls the block out widely.

CISA recommends beginning where the transition is easiest and moving towards critical assets as the team grows confident. That sits comfortably with the order above: the list shows where the organisation needs to end up, and the easy zones are where the team learns to get there without interrupting services.

What ENS, NIS2 and DORA expect

ENS in Spain

Measure mp.com.4 of Royal Decree 311/2022, on separating information flows in the network, does not apply in the basic category. In the medium category the organisation must choose at least one mechanism: VLANs, VPNs or physically separate media; if it chooses VLANs (enhancement R1), the network has to be split into at least a user subnet, a services subnet and an administration subnet.

In the high category VLANs are no longer enough, because VPNs or physical separation are required, and control of the interconnection point is added: who enters each segment, what information leaves it, and that the point itself is protected and monitored. The decree justifies it this way: segmentation keeps incidents confined to the segment where they happen.

NIS2

Commission Implementing Regulation (EU) 2024/2690 sets out the NIS2 measures for digital providers: DNS services, top-level domain registries, cloud, data centres, content delivery networks, managed and managed security service providers, online platforms and trust service providers. Point 6.8 of its annex deals with segmentation.

It calls for zones based on the risk assessment, separation from third parties' systems, critical systems kept in secured zones and communication between and within zones limited to what operations need. It also asks for an administration network kept apart from the operational one and for production to be separated from development and testing. Other NIS2 entities have no equally detailed text, but the ENISA technical guidance that accompanies the regulation offers direction: its examples of evidence include documented segmentation rules, and it recommends reflecting the zones in the network diagram.

DORA and ISO 27001

In financial services, Delegated Regulation (EU) 2024/1774, which details DORA's ICT risk management requirements, asks in Article 13 for systems and networks to be segregated and segmented according to the criticality of the functions they support, their classification and the risk profile of the assets, for all network connections and data flows to be documented, and for ICT assets to be administered from a separate, dedicated network. ISO/IEC 27001:2022 captures the same principle in Annex A control 8.22, segregation of networks.

How do you know the segmentation works?

The most revealing check starts from an ordinary user workstation with an unprivileged account: which services on other machines answer, which management consoles can be reached, which file shares open. An internal penetration test starts there, and an adversary simulation builds its path from the same point, because that test mirrors what an intruder arriving through a phishing email will have to hand.

The SOC provides the second check. Once the policy is live, a refused SMB or RDP connection between two user workstations should be unusual, so every blocked attempt is a signal to look at, much like a login to a decoy account.

The third is on paper, and it is the one auditors and supervisors ask for: a matrix of permitted flows between zones, each with its reason and owner, reviewed whenever systems change. An infrastructure and network security audit compares that matrix with the firewall rules actually in place, which over the years collect permissions nobody remembers requesting.

Where segmentation stops helping

Internal segmentation acts only on traffic that crosses the internal network. An attacker who steals a Microsoft 365 session moves through cloud services without passing any internal firewall, the scenario covered in our analysis of Microsoft 365 account takeover. Segmentation does not close paths left open on purpose either. If the whole workforce writes to a file server, that server stays reachable, and protecting it falls to permissions, backups and detection.

Segmentation also decays. Every new application brings new connections, and a flow matrix that nobody reviews fills up with permanent exceptions.

So the decision that matters most sits outside the network team's tooling. Rules can be written in a few weeks. The harder part is giving someone ownership of the flow matrix, with the authority to turn down a connection that has no business reason and with reviews booked in the diary. Without that person, an internal network flattens again, one exception at a time.

This article describes network architecture controls for defensive purposes, based on public documentation from CISA, the NCSC, ENISA, Microsoft, CrowdStrike, Sophos and Mandiant, and on the text of the ENS, Implementing Regulation (EU) 2024/2690 and Delegated Regulation (EU) 2024/1774 as available on 25 September 2026. Regulatory references are indicative and do not replace each organisation's own legal analysis. Any firewall rule change should first be tested in log-only mode or on a pilot group, because a poorly designed rule can interrupt services.