Technology
Network segmentation for local government
Why flat networks are dangerous, how to divide them, and how to do it without breaking operations.
Many agency networks grew organically into a single flat network where a compromised front-desk PC can reach the dispatch server, the water plant controller, and the finance system. Segmentation divides the network into zones with controlled paths between them, so that a compromise is contained.
Zones that agencies typically need
- Public safety systems under CJIS requirements
- Utility and building control systems
- Business systems: finance, HR, email
- General staff workstations
- Public and guest wireless
- Servers and infrastructure management
- Vendor and remote access
How it is done
VLANs and routing separate traffic. Firewalls or access control lists define which zones may talk to which, on which ports. Identity-aware policies can refine this by user and device. Monitoring watches the paths between zones.
Doing it without breaking things
- Inventory devices and map current traffic flows; observation before enforcement.
- Define zones and the allowed flows between them, with owners who confirm each.
- Implement in monitor-only mode and review what would have been blocked.
- Enforce zone by zone, starting with the most sensitive.
- Document and maintain the rules; review quarterly.
Common obstacles
Undocumented dependencies that surface only when blocked. Devices with hard-coded addresses. Vendors who insist on unrestricted access. Each is solvable, and each is a reason to go step by step.
Relationship to Zero Trust
Segmentation is one pillar of a Zero Trust architecture. It complements identity and device controls; it does not replace them.
Compliance drivers
CJIS expects criminal justice systems to be protected from general network access. Utility security guidance expects control networks to be isolated. Cyber insurers ask about segmentation. The work satisfies several obligations at once.