Segmentation and Access Control - CompTIA Security+ SY0-701 - 2.5

Network Segmentation

Network segmentation divides a network into smaller parts to limit the scope of security incidents, improve performance, or meet policy and compliance requirements.

Types of segmentation include:

• Physical: Devices are physically separated.
• Logical: Networks are separated using technologies such as VLANs.
• Virtual: Segmentation is used in cloud and virtual-machine environments.

Segmentation can reserve bandwidth for high-traffic applications, prevent users from connecting directly to sensitive systems such as database servers, or isolate regulated data—for example, payment-card information for PCI compliance.

Access Control Lists

Access control lists (ACLs) allow or deny access based on criteria such as source or destination IP address, ports, time, or user identity. Rules can be highly specific, such as permitting a user to reach a particular subnet only over selected TCP ports.

ACLs also apply to operating-system permissions for files, folders, users, and groups. When configuring them, administrators must account for existing connections and avoid rules that could prevent further administration.

Application Control

Application control can use either of these approaches:

• Allowlist: Permits only explicitly approved programs to run. This is restrictive but can block unapproved or malicious software.
• Blocklist: Prevents listed programs from running while allowing other programs. Antivirus and anti-malware systems are examples of this approach.

Windows can identify applications by their hash, digital signature, or disk location. It can also apply different program rules depending on the network zone, such as private or public.

Source

Professor Messer presents this instructional overview of segmentation and access controls as part of Security+ SY0-701 training.

Reviews, guides, or tutorials: None.