Perform Traffic Filtering Between Network Segments
Description
Perform traffic filtering between network segments, where appropriate.
Implementation Checklist
Tool Recommendations
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Enterprise firewall and security fabric with NGFW, SD-WAN, IPS, and integrated security services
Fortinet · Appliance + subscription
Enterprise firewall with application visibility, IPS, malware defense, and encrypted traffic analytics
Cisco · Appliance + subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Unrestricted Lateral Movement Between Network Segments
ConfidentialityAn attacker who compromises a workstation in the general user segment can directly access database servers and critical infrastructure because no traffic filtering exists between network segments.
Malware Propagation Across Flat Network
AvailabilityA worm or ransomware variant rapidly spreads from an infected endpoint to servers across all segments because inter-segment traffic is not filtered or restricted.
Unauthorized Access to Sensitive Segments from Compromised IoT Device
ConfidentialityA compromised IoT device on the corporate network gains direct access to PCI or sensitive data segments because no inter-segment traffic filtering policies restrict communication paths.
Vulnerabilities (When Safeguard Absent)
Flat Network Architecture Without Segmentation Enforcement
Without traffic filtering between segments, all network zones can communicate freely, eliminating containment boundaries and allowing compromises to spread across the entire network.
No Access Control Between Trust Zones
Absence of inter-segment filtering means high-security zones like payment processing or database tiers are reachable from lower-trust zones such as guest Wi-Fi or general workstations.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |