No Segmentation Between Trust Zones

What this finding is

Systems of materially different sensitivity share a routable broadcast domain or an unrestricted routing path, with no filtering enforced between them. A workstation VLAN can reach the database subnet; a development account peers unrestricted into production; a guest network resolves and routes to internal services. The condition is the absence of an enforcement point, not the presence of a specific rule.

Why it is Tier 1

Segmentation determines whether a single compromised endpoint is an incident or an outage. Ransomware operators depend almost entirely on lateral movement — the initial foothold is rarely a system worth encrypting — and a flat network converts one phished user into estate-wide access within hours. Beacon assigns 72 hours rather than 24 because meaningful segmentation cannot be safely deployed in a day; the extended window is for staged rollout, not for reduced priority.

How to detect it

1. 1Run authenticated reachability testing from a representative low-trust host to known critical services, rather than reading the intended firewall policy.
2. 2Analyse cloud flow logs for accepted traffic between subnets that policy says should not communicate.
3. 3Audit VPC peering, transit gateway routes, and VPN tunnels for transitive paths that bypass the intended inspection point.
4. 4Check whether security group rules reference broad CIDR blocks instead of peer security group identifiers — a common source of unintended reachability.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1. 1Identify and rank the crown-jewel systems first; segment inbound to those before attempting an estate-wide programme, which will not complete.
2. 2Deploy default-deny between zones with an explicit, documented allowlist for each required flow.
3. 3In cloud environments, reference security groups rather than CIDR ranges so that policy follows workloads through scaling events.
4. 4Isolate management and out-of-band interfaces onto a dedicated administrative network reachable only through a bastion.
5. 5Instrument the enforcement points with flow logging before tightening rules, so that break-fix is measured rather than guessed.

How to verify the fix

Mappings

Other Tier 1 findings in Network