Cybersecurity Network Segmentation

How it works

Segmentation separates systems so that compromise of one does not automatically expose every other service. A diagram alone does not enforce it: routing, firewall policy and identity must agree. Define needed communication by purpose, then test both the allowed and denied paths. Administrative access should have its own narrow route and audit trail.

Run the code

Save the complete source as network-segmentation.py in a separate learning folder, then run python network-segmentation.py. The reviewed runtime is Python 3.12.14 with the standard library; no third-party packages are required. These are local examples, not browser playground programs. Apache, MySQL and PHP are not needed.

Download the complete source

Local lab setup

Example

paths = {("guest", "catalog"), ("application", "database")}
assert ("guest", "database") not in paths
assert ("application", "database") in paths
print("guest database path: denied")

Expected result

guest database path: denied

The set describes an intended policy, not a live network. Guests can view the catalogue but have no direct database path. The application’s database permission must still be constrained to its job. Use actual network tests during deployment because a stale policy document can disagree with running rules.