Network Segmentation Review Workflow
Model intended traffic flows, capture actual flows from telemetry, and reconcile the two to expose unintended paths and over-broad rules.
Objective
Verify that the network permits only intended flows by reconciling the intended-flow model against observed traffic, shrinking rules to the difference.
Environment
- Flow logs or packet-level telemetry from the network layer
- An intended-traffic model (which tiers talk to which)
- Change access to firewall and security group rules
Steps
1. Model intended flows
Document the intended communication matrix: which services, tiers, and ports should talk, derived from architecture rather than from current rules.
Expected state: An intended-flow matrix exists that architecture owners sign.
2. Capture actual flows
Collect a representative window of flow logs, joining source and destination to service identities rather than bare IPs.
Expected state: An observed-flow dataset exists with service-level identities.
3. Reconcile observed against intended
Diff the two sets: observed-but-unintended flows are either missing documentation or real problems; intended-but-unobserved rules are candidates for removal.
Expected state: The reconciliation names every discrepancy with both endpoints.
4. Tighten rules to the observed need
Rewrite firewall and security-group rules to cover intended flows plus documented exceptions, removing anything never observed in the window and the history window.
Expected state: Rule count drops, and every rule maps to a flow in the matrix or a registered exception.
5. Re-run the reconciliation after tightening
Capture a second window post-change to catch flows that only fire weekly or monthly, iterating until the diff is empty or fully dispositioned.
Expected state: A second reconciliation shows no new breakage and the remaining diff items all dispositioned.
Expected outcome
A network where every permitted flow is either intended and documented or a registered exception, with rule bloat removed and unintended paths closed.
Verification
The final reconciliation shows zero undispositioned flows; rule count dropped measurably; a deliberately blocked unintended path fails in testing.
Rules accrete; flows are the truth
Firewall and security-group rules accumulate from every incident hotfix and every long-gone integration, until the network permits far more than anyone intends. Reconciling intended flows against observed flows replaces archaeology with evidence.
intended matrix (signed by owners):
web -> api:443 api -> db:5432
api -> cache:6379 batch -> db:5432
observed (14d window, service identity):
web -> api:443 OK
api -> db:5432 OK
api -> cache:6379 OK
batch -> db:5432 OK
api -> legacy-pay:8443 UNINTENDED (rule from 2023)
admin-pod -> *:ANY UNINTENDED (over-broad)
rules: 214 -> 96 (118 never observed, removed
after 14d + 30d history check)
re-run window: 2 monthly flows restored (registered)Never-observed rules are usually dead weight
A rule with no matching flow across representative windows (plus a monthly-job window) protects nothing and permits everything it describes. Removing it is the cheapest security improvement available — unless it is the break-glass path, which becomes a registered exception with a test.
The second window catches the slow fires
Monthly batch jobs and quarterly integrations do not appear in a two-week capture, so tightening based on one window breaks them. The reconciliation loop — tighten, observe again, disposition the new diff — converges on rules that are both minimal and complete.