In Severance, the employees of Lumon Industries live in a world of strict compartmentalization. Your work self cannot access what your personal self knows, and you certainly cannot wander into another department's floor without authorization. Every boundary is enforced at the threshold, with no exceptions. That is exactly what good network traffic filtering looks like.
What Is Perform Traffic Filtering Between Network Segments?
Traffic filtering between network segments means controlling what can talk to what across the internal boundaries of your network. Not every device needs to reach every other device, and not every segment should be accessible from every other segment.
The official CIS definition:
Perform traffic filtering between network segments, where appropriate, on enterprise assets. Example implementations include the use of a next generation firewall (NGFW) as a network gateway, or other network-based filtering solution (for example, router-based Access Control Lists (ACLs)).
The word "appropriate" is doing real work in that sentence. You are not required to filter everything everywhere. You are required to think about where the boundaries matter and actually enforce them there.
Why It Matters
Attackers who land inside one part of your network should not automatically inherit access to everything else. If your guest Wi-Fi can reach your financial systems, that is a problem waiting to happen. If a compromised workstation can talk directly to your domain controllers, attackers will use that path, and they will use it fast.
Traffic filtering creates friction. Friction slows attackers down. Slowing them down gives you time to detect and respond before the situation gets worse.
From a compliance perspective, frameworks like PCI-DSS, HIPAA, and NIST all point toward network segmentation with enforced boundaries. Auditors want to see documented controls. Traffic filtering rules are documented controls. This one does double duty.
Key Details or How It Works
- Network segments are logical groupings of assets: production servers, user workstations, guest access, IoT devices, and management interfaces each belong in their own zone.
- Traffic filtering rules define what is permitted to flow between segments. Everything else is denied.
- Next-generation firewalls (NGFWs) operate at Layer 7 and can filter based on application identity, user context, and behavior, not just IP addresses and ports.
- Router-based ACLs are a lighter-weight option that enforces basic filtering at Layer 3, appropriate for simpler environments or as a first step.
- East-west traffic (between internal segments) matters just as much as north-south traffic (to and from the internet). Most organizations underinvest here.
- A default-deny posture means traffic is blocked unless explicitly permitted. That is the correct default.
How to Implement Perform Traffic Filtering Between Network Segments
- Map your network segments. Before you can filter traffic, you need to know what segments exist. Document your zones: user workstations, servers, DMZ, OT/IoT, management network, guest. If distinct segments do not exist yet, define them now based on sensitivity and function.
- Identify the legitimate traffic flows between segments. Work with application owners and IT to catalog what communication actually needs to happen across boundaries. A web server in your DMZ reaching a database on a specific port is a permitted flow. Everything else is not. Build from that list.
- Deploy filtering controls at segment boundaries. A NGFW is the preferred tool for enforcing this at scale. For smaller or simpler environments, ACLs on managed switches or routers can provide baseline enforcement. Place the control point at the boundary where segments meet, not somewhere downstream.
- Configure rules with a default-deny posture. Start with deny-all and add explicit permit rules for known-good traffic. Do not start with permit-all and try to block the bad stuff. You will miss something, and attackers will find it before you do.
- Test and validate before calling it done. Verify that permitted traffic flows as expected and that denied traffic is actually blocked. Use scanning tools or traffic analysis to confirm boundaries are working. Misconfigurations are common and easy to miss without active validation.
- Build a periodic rule review into your process. Traffic filtering rules go stale. Applications change, systems move, and business requirements shift. Schedule a review cadence, tie it to your change management process, and keep the rules current.
Final Thoughts
Lumon's floor access controls are fictional and dystopian, but the underlying principle is sound. You do not let people wander freely between sensitive areas just because they are already inside the building. Your network should work the same way. Define your floors, enforce the boundaries, and make sure your filtering devices are actually doing the job you think they are. Attackers count on flat, open networks. Do not hand them one.
Resources
Here is a link to the Policy Templates provided free of charge from the fine folks at the Center for Internet Security.
Looking for even more detail? Here you go. If this still does not satisfy your curiosity, DM me.
Official CIS Text
CIS Control 13: Network Monitoring and Defense Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise's network infrastructure and user base.
CIS Safeguard 13.4: Perform Traffic Filtering Between Network Segments Perform traffic filtering between network segments, where appropriate, on enterprise assets. Example implementations include the use of a next generation firewall (NGFW) as a network gateway, or other network-based filtering solution (for example, router-based Access Control Lists (ACLs)).
Shameless Marketing Information
Gotham Technology Group helps organizations design and implement network segmentation strategies, from NGFW deployment and zone-based architecture to ACL configuration and policy review. If your network is flatter than it should be, we can help you change that.