A Boundary's Worth

A rule export shows intent, not effect. It cannot show whether the traffic ever reaches that device, whether an earlier or later rule matches first, or whether the device is in the path at all. Only traffic originated from inside the segment produces an outcome.

Two hosts in the same subnet talk directly through the switch and never reach the default gateway, so a border firewall is simply not on that path and records nothing. Only splitting them into separately routed subnets puts a device in the way.

It removes destinations, not authority. An intruder driving a working, authenticated session keeps every permission that account already held; segmentation only shortens the list of places the account can be used from.

They rewrite the policy instead of slipping past it. A permit they add is enforced as legitimate, the traffic that follows looks authorised in every downstream record, and the device's local change log is theirs to edit too.

Splitting one subnet into several forces traffic between them to a default gateway, and a policy applied at that routed hop is the first thing an intruder's lateral movement must cross. The cost is hairpinned traffic, added latency, a new failure domain and full re-addressing.

Absence of flow records is ambiguous: it means the device never saw the traffic, or that export was never configured, sampled it away, or dropped it. Confirm the forwarding path itself before you claim a bypass, because the claim buys an outage window somebody has to authorise.

A timeout proves only that no reply came back. It covers a filter silently discarding the packet, the packet never reaching the enforcing device at all, and the packet arriving at a destination that was off or not listening while the reply was dropped. A pass and a broken probe look identical.

On the wire the session is just an allowed address pair; on the workload an agent can tie the rule to the process that opened it. It still cannot see who drives that process, and it must run everywhere.

Everything those consoles trust. Device-administration AAA hands the logon decision to the directory, so one account in the right group is an administrator on the firewall, the sensor and the access-control policy at the same time.

Observe first, then move in the smallest reversible steps: build the permit set from real flows over a full business cycle, separate the routing change from the policy change, cut one zone pair or direction per night with a written rollback and a named owner, and accept that the gap stays open, with a dated end, until the last step.

Measure directed pairs, not zones: twelve zones give 132 ordered source-to-destination pairs before you count services. Spend the budget on low-trust sources into high-value destinations, on pairs whose denial is an actual control claim, and on pairs a change touched - and show every untested pair as unknown.

North-south volume is shaped by a purchased circuit; east-west is LAN traffic at switch speed - backups, imaging, file shares - and it is usually far larger and burstier. Size on measured crossing traffic, new connections per second and session count, not on the internet pipe.

Compute it as a closure, not a feeling. From the compromised origin list every allow entry still matching it, exceptions included, then repeat from each destination reached. The answer is that set times the account's rights.

Forty policies, from one seat. A shared management plane collapses forty boundaries into one, and each rewrite arrives at the client as an authorised provider change. Separating the seats spends exactly the efficiency that justified sharing them.

A fleet whose declared purpose is to originate cross-segment traffic, present in every low-trust segment, centrally managed across your own boundaries, holding a map of which pairs should be open, and deliberately excluded from alerting. Design it to be worthless when captured: no credentials, outbound-only management, and narrow suppression.

Empty border logs prove only that the traffic did not cross the border. A control that is not on the path produces no evidence in either direction. A record of interior movement exists only once you fund a routed hop and a device that inspects it.

Separate three problems: an unenforced boundary, an assertion already made to a third party, and a remediation nobody has funded. The technical gap gets compensating controls and a dated plan; the assertion is a legal and contractual question that is not the network team's to sit on; the outage windows belong to business owners who can refuse them.

Turn the refusal into a priced choice. Show how many destinations that single flow keeps reachable, offer narrowed versions instead of all or nothing, and if the owner still refuses, write the residual reach down and have them accept it by name.

The owner of the service whose availability the outage would hit, not the security team. A path that alone reaches the controls means its failure blocks every fix, so that risk needs a named owner's written acceptance and a tested break-glass.