Network segmentation limits lateral movement, so if one system is compromised, attackers cannot freely roam.
Weak or inconsistent segmentation is common. Even well-defended perimeters do not prevent internal abuse when segmentation fails.
Testing it requires hands-on, practical approaches, seeing what an attacker could realistically do.
Practical approaches to testing segmentation
1) Discover and Map Your Network
1. To validate the physical or logical accessibility of networked systems to each other; use Nmap or Masscan to identify which networks can reach which networks.
2. Example Test (Discover Networking from Guest segment):
Using a system that has limited privileges (Non-root access) on a guest VLAN run Nmap command:
nmap -sS -Pn 192.168.20.0/24 - and Observe which system(s) respond.
2) Validate ports/services for accessibility
1. Identify that only those expected ports/services are accessible; it can also be accomplished using both of the above tools as well.
2. Example Test: From, a non-authorized network subnet (7868), attempt to access a database server (192.168.10.15:3306) using:
nc -vz 192.168.10.15 3306 - and that any responses are considered to be unintended access.
3) Validate ACL's and Firewalls
1. Review your ACL's against what you intended the Segmentation of each of your Firewalls to be.
2. This can be done with Nessus, manual reviews of the Configuration and by reviewing the Cisco ASA/Juniper Configurations of your Firewalls for misconfigured segments.
4) Simulate Lateral Movement
1. Validate the ability an attacker would have in traversing between different Systems, this can be accomplished using Metasploit or BloodHound for Active Directory Network environments.
2. Example: If you compromised a low-privileged host within your Domain and were able to access sensitive Shares, Record pathways that allowed access.
5) Packet Captures and Traffic Analysis
Validate that traffic prohibited from traversing your segments does not occur undetected.
Using Wireshark or tcpdump, Review Packet Capture Files between segments to determine if protocols known to be blocked are present.
6) Testing API and application layers through an API.
1. Test whether users/apps can communicate with other services through the service layer in an application via API testing.
2. Tools Used include: Postman, Burp Suite, cURL.
3. Sample API Test: Attempt to access an internal API from a restricted area. If you can successfully do this, it indicates that segments have not been effectively implemented or established.
7) VLAN and subnet validation is reviewing.
1. Review the logical segments from an organisational standpoint, compared with how they are behaving on the network.
2. Example Tests could include using ping, traceroute, and testing to determine the manner in which VLANs route data to/from each other without the possibility of unintentional routing occurring.
8) Review of Service Accounts/Credentials.
1. The sharing and excessive permissions associated with service accounts can allow for bypassing segmentation.
2. Sample Test: Attempting to retrieve data from another segment via a service account, indicates that logical segmentation or segmentation has not been performed correctly.
9) Testing Automation for Scale.
1. Network size may mean the testing of the network manually requires significant amounts of time.
2. Tools Used for large-scale scanning include Masscan, Nmap scripts to conduct more detailed testing and custom Python scripts to determine which flows are allowed/disallowed.
3. Sample Test: Scan all subnets for potential access to critical servers and establish a reachability matrix indicating access times.
Real World Examples
Incident 1 - Unsafe Internal Network
1. A significant security weakness was the Guest VLAN that gave access to HR and Developer servers.
2. To examine this problem, the tester ran a simple ping and/or port scan against the network and found that the path to HR and Development servers was not documented in the proper physical Network layout or topological format.
Incident 2 - Old Firewall ACL Rules
1. Firewall ACL Rules are outdated (no updates/review) and configuration has not been reviewed/updated for years.
2. Test Method - Metasploit lateral movement test to determine if finance shared drives were available from test machine and/or accessible via MITM.
Incident 3 - Cloud Network Configuration Issue
1. VPCs expected to be isolated were actually reachable due to misconfigured routing.
2. Test Method - Traceroute/API calls to confirm the existence of unrestricted access.
Best Practices for Conducting Practical Tests
1. Conduct testing from multiple segments (as opposed to testing from only your Admin Network) to validate your results.
2. Use both automated and manual block/permit testing to ensure accurate results as much as possible.
3. Verify both business-level (e.g., company policy) and network-layer (i.e., ACLs) when testing.
4. Conduct audits in the same order as previously stated, which should be done periodically and after any changes are made.
5. Be sure to record all findings including any unintended flows and their effects on business.
Leadership takeaway
Weak segmentation is often not seen until it is tested.
Practical assessments identify not only general technical deficiencies but also operational risk factors that include:
1. Which internally exposed systems are vulnerable
2. The potential extent of reach from a compromise
3. Which controls are truly effective vs. being used as a symbolic gesture.
Testing tools and practical exercises will force risk to be visible and actionable rather than simply being a theoretical concern.
