A computer inside an organization is not automatically a trusted neighbor. Network segmentation limits which systems can communicate; device isolation restricts a particular machine during investigation. Both depend on enforced rules and a clear operational plan.
This page originally described a 2004 Network Virus Wall appliance. Its lasting subject is internal spread. The approach below helps a small-team IT owner map that problem without treating any single box as a complete defense. Changes to a live network belong with its administrator and incident responder.
Draw the connections that work requires
Start with a simple inventory: user devices, shared storage, servers, administration interfaces, printers, guest access and backup systems. For each connection, record the business purpose, owner and permitted direction. A diagram that says only “office network” hides the relationships you need to assess.
NSA and CISA’s guidance on common misconfigurations identifies insufficient network segmentation as a recurring issue. Separate network labels are not enough: the controls between segments must enforce the intended access. A VLAN assignment without suitable restrictions may not provide the boundary you expect.
Examine administration and backup access especially carefully. Ordinary user tasks rarely need the same reach as management tools. Keep a documented route for legitimate administration rather than making broad access the default.
Fictional example: an eight-person office
The office uses managed laptops, a shared file service, a printer, guest Wi-Fi and a backup system. The following is a discussion model, not a configuration to copy. An administrator must account for discovery, authentication, updates and other real dependencies.
| Connection | Intended purpose | Evidence to seek |
|---|---|---|
| Staff laptop to file service | Use authorized shared documents. | Required access works; unnecessary shares and management interfaces are restricted. |
| Guest device to Internet | Provide visitor connectivity. | A harmless authorized check confirms guests cannot reach internal services. |
| Staff laptop to printer | Submit print jobs. | Printing works without granting broad printer-administration access. |
| Backup administration to backup system | Manage recovery copies. | Only designated administration access is allowed; restore tests succeed. |
Write down failures as well as successes. If a required task stops working, identify its actual dependency. Reopening every connection may restore convenience while discarding the boundary you set out to create.
Plan isolation before an incident
The CISA-led ransomware guide emphasizes isolating affected systems and preserving evidence. In a managed environment, the responder should decide how to contain the device while retaining needed investigative access. A home user’s unplugged network cable and a centrally managed isolation action are not necessarily equivalent operationally.
Record who can authorize isolation, who performs it, how the decision is communicated from a trusted device, and what business function may be interrupted. Avoid improvising changes to shared network equipment during a crisis. Consider connected storage and other communication paths rather than assuming that one disconnected interface settles the scope.
Isolation reduces communication; it does not remove malware or prove that other machines were untouched. The investigation still needs to assess the entry point, accessed resources and related activity.
Verify the boundary and the recovery decision
- Confirm intended restrictions. Use administrator-approved, harmless connectivity checks and relevant logs. Stay within systems you are authorized to assess.
- Confirm needed work still functions. Test agreed business tasks through their normal paths.
- Document exceptions. Give temporary access a purpose, owner and expiry or review date.
- Set return-to-service evidence. Identify the required remediation, patch state, account review and monitoring before reconnecting an affected device.
- Review after changes. New services, remote access and replacement devices can change the map.
For the fictional office, a useful tabletop question is: “If one laptop were compromised, which of these resources could it change?” Follow that with: “What evidence supports the answer?” This exposes assumptions about permissions as well as network access.
Keep segmentation in its proper role
Network controls complement supported software, endpoint protection, account controls and recoverable backups. Allowed connections can still carry harmful activity. Monitoring needs someone who reviews it, and an exception can quietly become permanent if nobody owns it.
The historical Sasser and Nimda studies show why different propagation routes require different checks. Use the recovery guide for the broader device-and-account sequence.