## Microsegmentation

The technique to stop Lateral Movement.

### Concept
Instead of one big "Internal" VLAN, break the network into tiny islands.
*   **Macro-Segmentation**: VLANs. (HR, Finance, IT).
*   **Micro-Segmentation**: Host-level firewalls.
    *   "Server A can talk to Server B on Port 443."
    *   "Server A can talk to Server C on Port 3306."
    *   "Server A **cannot** talk to Server D."

### Implementation
1.  **Tagging**: Map the application flow. "Web calls App calls DB".
2.  **Policy**: Write "Allow" rules for valid flows.
3.  **Default Deny**: Block everything else.

### The Effect
If an attacker compromises the Web Server, they are trapped in a small padded cell. They cannot scan the network (blocked). They cannot SSH to the DB (blocked).