Segmentation & Microsegmentation

North-south volume is shaped by a purchased circuit; east-west is LAN traffic at switch speed - backups, imaging, file shares - and it is usually far larger and burstier. Size on measured crossing traffic, new connections per second and session count, not on the internet pipe.

Compute it as a closure, not a feeling. From the compromised origin list every allow entry still matching it, exceptions included, then repeat from each destination reached. The answer is that set times the account's rights.

Forty policies, from one seat. A shared management plane collapses forty boundaries into one, and each rewrite arrives at the client as an authorised provider change. Separating the seats spends exactly the efficiency that justified sharing them.

The events business owns the decision, because the revenue is theirs to trade; you own stating the cost accurately. Write a per-room exception with a named owner, an expiry tied to the booking, and what one guest reaches.

A label change is evaluated for new connections; established state is not re-checked, and the write takes time to reach every enforcement point. Isolation must flush that state and verify the flows stopped.

A fleet whose declared purpose is to originate cross-segment traffic, present in every low-trust segment, centrally managed across your own boundaries, holding a map of which pairs should be open, and deliberately excluded from alerting. Design it to be worthless when captured: no credentials, outbound-only management, and narrow suppression.

Empty border logs prove only that the traffic did not cross the border. A control that is not on the path produces no evidence in either direction. A record of interior movement exists only once you fund a routed hop and a device that inspects it.

Refuse to say that permitted equals authorised, that every conduit has a purpose, or that lateral movement is prevented. Claim only that traffic absent from the window is denied, and price what a stronger claim would cost.

Refuse the shape rather than the devices. Convert a blanket, indefinite exception into per-device enumerated permits with an expiry and a named owner, and get the residual risk accepted in writing by someone senior enough to accept it.

Argue from reachability, not asset value: this is the one tier every segment may already reach, so its blast radius is the whole estate. Buy the change windows, the separate administration path and the evidence with that argument.

An intruder's path is assembled from individually approved changes, so rubber-stamping is the failed control. Name the real ceiling - review capacity, not rule count - and make the funder choose: pay for reachability testing, or accept a coarser grain.

Separate three problems: an unenforced boundary, an assertion already made to a third party, and a remediation nobody has funded. The technical gap gets compensating controls and a dated plan; the assertion is a legal and contractual question that is not the network team's to sit on; the outage windows belong to business owners who can refuse them.

Turn the refusal into a priced choice. Show how many destinations that single flow keeps reachable, offer narrowed versions instead of all or nothing, and if the owner still refuses, write the residual reach down and have them accept it by name.

The owner of the service whose availability the outage would hit, not the security team. A path that alone reaches the controls means its failure blocks every fix, so that risk needs a named owner's written acceptance and a tested break-glass.