Organizations spend a lot of time thinking about advanced stuff. Right now it’s AI — everybody talks about what AI can do, what it can detect, what it can automate, what are the AI threats. Fine, that’s where the market is right now.
But if you actually look at incident, most of them don’t come from a lack of advanced technology. They come from missing fundamentals. If organizations just stuck to the basic principles, a large part of these incidents wouldn’t happen at all.
So let’s take a step back. From a network security point of view, one of those fundamentals is segmentation.
VLANs — the starting point
You need VLANs configured on your switches — a proper set of VLANs, properly assigned to end devices.
Here’s problem number one. If you have NAC in place, VLANs assignment is handled for you — NAC decides which VLAN a device belongs to, automatically, based on identity or posture. Without NAC? Doing this manually doesn’t work — devices end up in the wrong segments. It drifts out of sync over time. Devices sitting in the wrong segments, and that’s it.
Firewall
Second problem. Once your network is segmented, you need to filter traffic between VLANs. That’s the firewall’s job. Sounds simple, right — just apply block by default, allow by design principle.
In practice, this is one of the hardest parts of the whole exercise. First, you need to identify what rules you actually need, and that’s a long process, especially if the network wasn’t segmented before and has to be segmented from scratch.
And even once segmentation is in place and rules exist, they usually stay pretty general. Keeping strict, granular firewall rules takes real, ongoing effort — and that’s exactly the resource most organizations don’t have enough of.
Bottom line
I’ve seen this pattern more than once: organizations with real gaps in the fundamentals, still focused on advanced stuff. Fundamentals like segmentation sit underneath — nobody outside the network team ever sees them. Advanced stuff is visible at a glance, you can point at it and show that something got done. So organizations often end up building the advanced layer without the foundation underneath it.
You can have a house fully equipped on the inside, but if the foundation underneath is weak, it doesn’t matter — it won’t work. It’s exactly the same with security. AI, automation, whatever’s trendy this year — none of it means much if fundamentals like segmentation aren’t good.