What Good L3/L4 Policy Can Actually Do

Thu, 09 Jul 2026 00:00:00 +0000

In 2019 I published a short article about MITRE ATT&CK and segmentation.

The point was simple: when ATT&CK maps adversary techniques to mitigations, network segmentation shows up in more places than many people expect. It is not only a perimeter control. It appears across the attack lifecycle because attackers need reach.

That old point still holds.

But it deserves a 2026 reassessment.

The original post was written in a world where many segmentation conversations still meant VLANs, firewall zones, and large network boundaries. Today the conversation is broader. We have cloud security groups, Kubernetes network policies, host firewalls, software-defined segmentation, identity-aware access paths, workload labels, service maps, and microsegmentation platforms.

Mitre-Attack on microsegment.io

What Good L3/L4 Policy Can Actually Do