Continuous segmentation: what does it mean for NAC teams?

TL;DR: Network segmentation degrades as device inventories, IP addresses, and traffic patterns change, leaving NAC and DACL enforcement out of sync with intended policy, according to Asimily. The analysis argues that continuous evaluation is now the difference between segmentation on paper and segmentation that still holds in operational networks.

Editorial analysis by NHI Mgmt Group, based on content published by Asimily: “Continuous Segmentation is Your Best Defense Against Modern Attacks”.

By the numbers:

• 79% of organizations called segmentation a priority, according to Asimily.
• 33% had fully implemented it, according to Asimily.
• 87% said their approach needs improvement, according to Asimily.

Key questions

Q: What breaks when segmentation policies are too broad or too static?

A: Broad or static policies often leave more connectivity open than teams realise, which weakens containment and creates blind spots during incidents.

Q: Why does device drift increase segmentation risk in IoT and OT networks?

A: Device drift changes the facts segmentation depends on, including IP address, function, and risk posture.

Q: How do security teams know if identity-based segmentation is actually working?

A: Teams should test whether a compromised or simulated compromised host can reach anything beyond the minimum required set of services.

Practitioner guidance

• Define segments by device intent, not static host lists Use device type, function, manufacturer, and risk profile as the policy basis so the segment can survive IP changes and hardware churn.
• Feed NAC with live visibility and risk context Connect passive monitoring, safe scanning, and exploitability analysis to the segmentation workflow so policy decisions reflect current conditions.
• Automate policy removal when devices no longer qualify Revoke prior NAC policies automatically when a device changes role, firmware state, or behavior so stale access does not persist.

Bottom line: Static segmentation policies age quickly when device inventories, IP addresses, and traffic patterns change faster than humans can review them.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →