Management paths can bypass segmentation
The network you built to manage everything frequently reaches everything, which makes it the shortest path between any two zones.
Monitoring agents, backup systems, remote administration tools and the jump host all need broad access by design. An attacker who reaches the management network has usually found a route that bypasses every boundary drawn elsewhere. It deserves stricter treatment than the zones it administers, and commonly gets less.
More on Network segmentation
- Segmentation limits paths, not compromise itselfBulkheads, not armour
- Every firewall allow rule creates a permitted pathEvery rule is a hole
- Flat networks turn local trust into broad reachabilityOne floor, no walls
- Microsegmentation moves boundaries closer to workloadsMove the fence inwards
- Default deny makes new paths deliberateNothing moves until a lever is pulled
- Network zones should reflect trust and functionZones follow the job