Segmentation splits a network into zones. Isolation is wider, and that is why it matters more than a firewall slide suggests: it keeps a failure in one place. An account, a process, a host, a backup, and the admin path should not fall in one move.
The first click on an attachment is rarely the end of the story. The end is a layout where the same local administrator password works on twenty computers, the backup sits on a share that computer can overwrite, and the hypervisor panel opens in the same browser that just handled the attachment.
Isolation matters because it shortens the list of things that disappear together.
Where it is usually missing
Five layouts I see more often than a flat network on a diagram:
- One local administrator password on every host. One recovered hash opens the rest.
- The everyday account — the one that reads mail — in the administrators group. The browser then has rights over the system.
- A backup on the same disk, or on a share the production user can write. An encrypted server encrypts the “backup” too.
- RDP, SSH, iLO, or the virtualization console reachable from the network where people read mail.
- One computer that holds mail, the VPN token, and the console to the servers.
Each item is its own decision. Together they mean: a laptop compromise is an environment compromise.
What to split first
The account. Work and administration are two logons. Administration happens without mail in the same session. A separate workstation is cleaner. A separate account on the same laptop is weaker, and still better than one login for everything.
The backup. An infected host should not be able to delete it. Different credentials, no write from the user network, a copy that is not connected all the time. A week-old version that only another account can touch is an isolation layer. A “backup” disk permanently attached to the same account is not.
A suspect host. In an incident, isolation means: cut it off the network and leave the disk. A reboot, an “antivirus cleanup”, and logging onto it with a domain account mix the traces and can write new ones. The intake → decision order is in the IR checklist.
A file you do not know. A separate machine, or a separate profile. Not the same desktop that holds the mailbox and access to the servers.
Lab and production
In a home lab, isolation is cheap. A separate virtual machine, a separate management network, a snapshot the guest cannot touch. On production the principle is the same and the change is slower: the drawing first, then the account, then the backup, and last “from today nobody is an administrator because it is convenient”.
Segmentation is still required — without it a laptop scans everything it can hear on the LAN. Segmentation alone will not hold an environment where the administrator sits in the same session as the browser, and the only backup is writable by that same user.