mikrosegmenter

Mikrosegmenter are a security approach that divides a computer network into many small, isolated segments around individual workloads or services. Each segment enforces its own access controls, so even if an attacker breaches one part of the network, lateral movement to other parts is limited. In many languages, including Danish, Norwegian, and Swedish, the term mikrosegmenter is used to refer to these segments, while the English term micro-segmentation is more common in security literature.

Implementation relies on identity-aware and policy-driven controls. Central policy management defines which entities can access which workloads, based on user identity, service identity, workload metadata, or labels, rather than solely on IP addresses. Enforcement points can be virtual firewalls, host-based agents, or built-in security features of hypervisors and cloud platforms. Technologies involved include software-defined networking (SDN), network virtualization, Kubernetes network policies, service meshes, and cloud-native security groups or firewall rules.

Typical use cases include data centers handling sensitive data (PCI-DSS, HIPAA), multi-tenant clouds, and regulated environments where breach containment and auditability are important. Benefits include a smaller attack surface, finer-grained access control, and improved ability to detect and contain breaches. Challenges include operational complexity, policy drift over time, potential performance and latency overhead, and the need for consistent policy across hybrid environments.