Micro-segmentation is a security method, and the software that applies it, that divides a company's network into many small zones, so that an intruder who breaks into one server cannot move on to the others. Each zone may be a single application, or even a single server. Rules decide which zones may connect to which.
Inside many data centres, the network is flat. That means any server can connect to any other server. This is convenient, but it helps an attacker. Say an attacker gets into one unimportant server through a known flaw. From there, the attacker can reach every other server. This movement from one machine to the next is called lateral movement. Ransomware spreads in this way, and can lock the files on hundreds of servers in one night.
Micro-segmentation replaces the flat network with rules. It follows the idea of least privilege: each server may connect only to the servers it really needs. The rules are usually enforced by a small program on each server, an endpoint agent, which controls the server's own built-in firewall. So no new network equipment is needed. The rules refer to labels, not addresses. For example, a rule may say: "Only servers labelled checkout may connect to servers labelled payments database." When a new checkout server starts, it gets the label, and the rule covers it at once.
Consider an online furniture retailer in Bengaluru with 1,200 servers. First, the software spends 30 days in watch mode. It blocks nothing. It records which servers actually connect to which, and draws a map. The security team finds that the payments database receives connections from only six checkout servers. So the team writes a rule that allows only those six, and switches it on. Two months later, an attacker breaks into the server that runs the company's blog, through a flaw in old blogging software. The attacker tries to connect to the payments database. The connection is blocked, and the attempt is reported to the SIEM. The attacker cannot get beyond the blog server.
The map from watch mode is useful on its own too. Attack path analysis uses this kind of information to work out which routes an attacker could take. The same method protects machines on factory floors, as part of OT and IoT security. In the cloud, cloud workload protection (CWPP) applies similar rules to containers.
Micro-segmentation is a practical form of zero trust inside the data centre. A firewall checks connections at the edge of the network. Micro-segmentation checks connections at every server.