Network-segmentation-cheat-sheet is a reference guide that documents best practices for dividing corporate networks into isolated segments.
The guide addresses the challenge of protecting production environments and sensitive systems from compromise spreading across a network. It presents segmentation as a layered approach, starting with basic firewall-based isolation between corporate and production zones, then progressing to more sophisticated multi-segment architectures that duplicate critical infrastructure and enforce stricter access controls. The core principle is that network boundaries represent firewall crossing points, and each level of segmentation increases the difficulty for an attacker to move laterally after compromising a single workstation.
Organizations should adopt this guide if they need to design or evaluate their network isolation strategy. Level 1 segmentation suits companies seeking basic protection against targeted attacks with minimal infrastructure changes, though it leaves administrative and user workstations with access to production systems. Level 2 and beyond are appropriate for organizations that can tolerate higher operational complexity and cost in exchange for stronger isolation, including separate infrastructure for development, testing, and production environments. The guide is designed to be applicable across companies of different sizes and industries.
The project consists of visual diagrams and schema documentation showing network topology at each segmentation level, with accompanying explanations of advantages, disadvantages, and attack vector protections. Development appears focused on maintaining and refining these reference architectures, with releases containing updated diagram versions and schema sources available in the repository.
