M1030: Network Segmentation
Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise.
Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like firewalls, routers, and cloud-based configurations. This mitigation can be implemented through the following measures:
Segment Critical Systems:
- Identify and group systems based on their function, sensitivity, and risk. Examples include payment systems, HR databases, production systems, and internet-facing servers. - Use VLANs, firewalls, or routers to enforce logical separation.
Implement DMZ for Public-Facing Services:
- Host web servers, DNS servers, and email servers in a DMZ to limit their access to internal systems. - Apply strict firewall rules to filter traffic between the DMZ and internal networks.
Use Cloud-Based Segmentation:
- In cloud environments, use VPCs, subnets, and security groups to isolate applications and enforce traffic rules. - Apply AWS Transit Gateway or Azure VNet peering for controlled connectivity between cloud segments.
Apply Microsegmentation for Workloads:
- Use software-defined networking (SDN) tools to implement workload-level segmentation and prevent lateral movement.
Restrict Traffic with ACLs and Firewalls:
- Apply Access Control Lists (ACLs) to network devices to enforce "deny by default" policies. - Use firewalls to restrict both north-south (external-internal) and east-west (internal-internal) traffic.
Monitor and Audit Segmented Networks:
- Regularly review firewall rules, ACLs, and segmentation policies. - Monitor network flows for anomalies to ensure segmentation is effective.
Test Segmentation Effectiveness:
- Perform periodic penetration tests to verify that unauthorized access is blocked between network segments.
Security context for executives and security teams
M1030: Network Segmentation describes Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise. Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like firewalls, routers, a...
Executive priority
M1030: Network Segmentation is an official MITRE ATT&CK mitigation. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate M1030: Network Segmentation by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether M1030: Network Segmentation appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Network Segmentation
Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise.
Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like firewalls, routers, and cloud-based configurations. This mitigation can be implemented through the following measures:
Segment Critical Systems:
- Identify and group systems based on their function, sensitivity, and risk. Examples include payment systems, HR databases, production systems, and internet-facing servers. - Use VLANs, firewalls, or routers to enforce logical separation.
Implement DMZ for Public-Facing Services:
- Host web servers, DNS servers, and email servers in a DMZ to limit their access to internal systems. - Apply strict firewall rules to filter traffic between the DMZ and internal networks.
Use Cloud-Based Segmentation:
- In cloud environments, use VPCs, subnets, and security groups to isolate applications and enforce traffic rules. - Apply AWS Transit Gateway or Azure VNet peering for controlled connectivity between cloud segments.
Apply Microsegmentation for Workloads:
- Use software-defined networking (SDN) tools to implement workload-level segmentation and prevent lateral movement.
Restrict Traffic with ACLs and Firewalls:
- Apply Access Control Lists (ACLs) to network devices to enforce "deny by default" policies. - Use firewalls to restrict both north-south (external-internal) and east-west (internal-internal) traffic.
Monitor and Audit Segmented Networks:
- Regularly review firewall rules, ACLs, and segmentation policies. - Monitor network flows for anomalies to ensure segmentation is effective.
Test Segmentation Effectiveness:
- Perform periodic penetration tests to verify that unauthorized access is blocked between network segments.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1565.003 | Runtime Data ManipulationSub-technique | Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering. |
| Enterprise | T1613 | Container and Resource Discovery | Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. |
| Enterprise | T1098 | Account Manipulation | Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems. |
| Enterprise | T1136 | Create Account | Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts. |
| Enterprise | T1021.001 | Remote Desktop ProtocolSub-technique | Do not leave RDP accessible from the internet. Enable firewall rules to block RDP traffic between network security zones within a network. |
| Enterprise | T1190 | Exploit Public-Facing Application | Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure. |
| Enterprise | T1602.002 | Network Device Configuration DumpSub-technique | Segregate SNMP traffic on a separate management network.CitationUS-CERT TA17-156A SNMP Abuse 2017 |
| Enterprise | T1136.003 | Cloud AccountSub-technique | Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems. |
| Enterprise | T1563.002 | RDP HijackingSub-technique | Enable firewall rules to block RDP traffic between network security zones within a network. |
| Enterprise | T1489 | Service Stop | Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions. |
| Enterprise | T1048 | Exfiltration Over Alternative Protocol | Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.CitationTechNet Firewall Design |
| Enterprise | T1612 | Build Image on Host | Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. |
| Enterprise | T1482 | Domain Trust Discovery | Employ network segmentation for sensitive domains.CitationHarmj0y Domain Trusts. |
| Enterprise | T1098.001 | Additional Cloud CredentialsSub-technique | Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems. |
| Enterprise | T1046 | Network Service Discovery | Ensure proper network segmentation is followed to protect critical servers and devices. |
| Enterprise | T1563 | Remote Service Session Hijacking | Enable firewall rules to block unnecessary traffic between network security zones within a network. |
| Enterprise | T1571 | Non-Standard Port | Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment. |
| Enterprise | T1133 | External Remote Services | Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. |
| Enterprise | T1072 | Software Deployment Tools | Ensure proper system isolation for critical network systems through use of firewalls. |
| Enterprise | T1669 | Wi-Fi Networks | Network segmentation can be used to isolate infrastructure components that do not require broad network access. Separate networking environments for Wi-Fi and Ethernet-wired networks, particularly where Ethernet-based networks allow for access to sensitive resources. |
| Enterprise | T1021.003 | Distributed Component Object ModelSub-technique | Enable Windows firewall, which prevents DCOM instantiation by default. |
| Enterprise | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolSub-technique | Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.CitationTechNet Firewall Design |
| Enterprise | T1557 | Adversary-in-the-Middle | Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity. |
| Enterprise | T1552.007 | Container APISub-technique | Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. |
| Enterprise | T1602 | Data from Configuration Repository | Segregate SNMP traffic on a separate management network.CitationUS-CERT TA17-156A SNMP Abuse 2017 |
| Enterprise | T1048.003 | Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique | Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.CitationTechNet Firewall Design |
| Enterprise | T1095 | Non-Application Layer Protocol | Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces. |
| Enterprise | T1565 | Data Manipulation | Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering. |
| Enterprise | T1602.001 | SNMP (MIB Dump)Sub-technique | Segregate SNMP traffic on a separate management network.CitationUS-CERT TA17-156A SNMP Abuse 2017 |
| Enterprise | T1557.001 | Name Resolution Poisoning and SMB RelaySub-technique | Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity. |
| Enterprise | T1021.006 | Windows Remote ManagementSub-technique | If the service is necessary, lock down critical enclaves with separate WinRM infrastructure and follow WinRM best practices on use of host firewalls to restrict WinRM access to allow communication only to/from specific devices.CitationNSA Spotting |
| Enterprise | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 ProtocolSub-technique | Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.CitationTechNet Firewall Design |
| Enterprise | T1136.002 | Domain AccountSub-technique | Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts. |
| Enterprise | T1040 | Network Sniffing | Deny direct access of broadcasts and multicast sniffing, and prevent attacks such as Name Resolution Poisoning and SMB Relay |
| Enterprise | T1199 | Trusted Relationship | Network segmentation can be used to isolate infrastructure components that do not require broad network access. |
| Enterprise | T1210 | Exploitation of Remote Services | Segment networks and systems appropriately to reduce access to critical systems and services to controlled methods. |
| Enterprise | T1610 | Deploy Container | Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.2 | Current bundle | de4f21b785ab… | ||
| 19.1 | 1.2 | Older bundle | de4f21b785ab… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]mitre-attackM1030Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.