Why Flat Networks Are Dangerous
In a flat network, all systems can communicate with all other systems. When an attacker compromises a single endpoint, they gain free lateral movement — able to reach domain controllers, databases, and production systems without restriction.
Segmentation Zones
- DMZ: Publicly accessible services (web servers, APIs) isolated from internal systems.
- Application Tier: Application servers that only accept traffic from the web tier.
- Data Tier: Databases accessible only from the application tier, never directly from the internet.
- Management Plane: Administrative access separated onto a dedicated network with strict MFA requirements.