CYBER SECURITY / NETWORK SEGMENTATION / VS-NfD
Sensitive project information, development environments and administrative systems need clearly controlled communication paths. Network segmentation reduces exposure when security boundaries are enforced in practice, not merely drawn on an architecture diagram.
Start a confidential discussionThe challenge
Network segmentation divides an IT environment into distinct zones and limits communication between them to what is necessary. Properly implemented, it can reduce unintended data flows and make lateral movement after a compromise more difficult.
Effective separation depends on more than addressing or VLAN assignments. Routing, firewall rules, identities, shared services, privileged administration, backups and remote access all influence whether a boundary actually holds.
For defence suppliers and projects involving information classified VS-NfD (German Verschlusssache – Nur für den Dienstgebrauch), there is a further question: which systems are authorised to handle that information under the applicable requirements? Segmentation alone does not constitute approval to operate classified-information IT.
Security architecture
The right zone model follows the organisation’s systems, information, operational dependencies and contractual security requirements. These four domains are examples, not a universal design or an approval model.
Workstations, general business applications and collaboration services need reliable connectivity, but not automatic access to higher-protection environments.
Administrative identities, management interfaces, jump hosts, remote maintenance and backup services require access paths distinct from routine user traffic.
Engineering, testing, production and industrial environments, including supplier connections, need communication paths defined by their specific risks and functions.
Information classified VS-NfD must be handled only within suitable, appropriately approved IT environments and with the protections and interfaces required for the specific assignment.
Beyond the diagram
A practical segmentation design must account for more than user and server subnets. Shared directory services, monitoring, updates, telemetry, backups, service providers and privileged access can create dependencies across nominally separate environments.
Necessary flows should be explicitly permitted, traceable and tested. Unneeded routes remain closed. Every operational change must preserve the intended security boundary.
Working together
The scope is agreed around the actual environment. Architecture, migration and operational controls must be realistic enough to maintain after implementation.
Map systems, applications, information classes, owners and existing communication dependencies.
Establish security zones, trust boundaries and interfaces based on protection needs.
Plan and coordinate routing, firewall rules, privileged access and controlled administration.
Test permitted paths, constrain exceptions and incorporate controls into change management.
A segmented corporate network does not automatically become approved classified-information IT through firewall rules, VLANs or Zero Trust measures. The applicable German security requirements, the contract and the competent approving authorities determine what is permitted. This example is not a system approval or legal determination.
Frequently asked questions
Technical effectiveness and formal security requirements need to be considered together, without confusing one for the other.
Segmentation divides an infrastructure into zones with defined communication paths. Network separation emphasises the effective security boundary between areas with different protection or trust levels. The chosen architecture must enforce that boundary in practice.
No blanket conclusion can be drawn from a VLAN configuration. A VLAN may form part of an architecture, but it does not by itself establish effective separation or authorisation to handle classified information. Applicable requirements and approval arrangements determine what is acceptable.
Zero Trust evaluates access based on identity, authorisation, device posture and context rather than assuming that an internal network is trusted. Segmentation complements this approach by restricting which systems and services are reachable in the first place.
Privileged accounts, supplier access, authentication, maintenance windows, session logging and the boundaries around production or sensitive environments all need to be addressed. Shared services and emergency access paths deserve particular attention.
Start with an accurate view of systems, information flows and critical operational dependencies. Only then define zones, necessary connections and a migration plan that can be tested and maintained in normal operations.
Confidential enquiry
Whether the requirement concerns network architecture, controlled trust boundaries or preparation for a VS-NfD project, the first discussion can establish scope using non-classified information.
Please do not submit classified material through a standard website contact form. Agree a suitable confidential channel before sharing sensitive details.
Share the essential context of your request.