Networks should be built in a way that assumes compromise and limits the damage an adversary causes through lateral movement. This is accomplished by controlling, isolating, and segmenting all network components, both physical (hardware) and logical (software), using specific policies and applying advanced access controls. 

 

Network segmentation (Micro and Macro) divides a network into smaller, separate pieces called sub-networks, allowing IT personnel to compartmentalize them and provide separate security controls and services to each of them independently.