[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-22":3},{"item":4,"lessons":16,"controls":42,"related":70},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-22","Annex A 8.22","ISO\u002FIEC 27001:2022 Annex A 8.22: Segregation of networks",6,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects groups of information services, users and information systems to be segregated in the organisation's networks. The aim is to split networks into security boundaries and control traffic between them based on business needs.\n\n**In practice.** Good practice means dividing networks into separate domains based on trust level, criticality and function, for example separating user, server, management, guest and OT networks, and controlling traffic between them. Cloud environments apply equivalent separation through virtual networks and security groups. Auditors look for network diagrams showing segments, rules controlling traffic between them and reviews of those rules.\n\n**Common gaps.** Common gaps are flat networks, management interfaces reachable from user segments and guest or IoT networks that can reach internal systems. Rules between segments also tend to grow broader over time without review.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38],{"slug":19,"title":20,"published_at":21},"ransomware-hits-japanese-railway-giant-keio-disrupts-hospitality-payment-systems","Ransomware Hits Japanese Railway Giant Keio, Disrupts Hospitality Payment Systems","2026-09-28T22:20:40.912+00:00",{"slug":23,"title":24,"published_at":25},"tp-link-omada-flaws-enable-device-impersonation-and-credential-theft","TP-Link Omada Flaws Enable Device Impersonation and Credential Theft","2026-08-06T14:20:38.761+00:00",{"slug":27,"title":28,"published_at":29},"anthropics-ai-escapes-sandbox-due-to-misconfigured-test-environment","Anthropic's AI Escapes Sandbox Due to Misconfigured Test Environment","2026-07-31T02:20:45.599+00:00",{"slug":31,"title":32,"published_at":33},"critical-vmware-esxi-vm-escape-flaw-demands-immediate-patching","Critical VMware ESXi VM Escape Flaw Demands Immediate Patching","2026-07-29T12:20:21.864+00:00",{"slug":35,"title":36,"published_at":37},"ai-agent-sandbox-escape-highlights-timeless-security-fundamentals","AI Agent Sandbox Escape Highlights Timeless Security Fundamentals","2026-07-28T22:21:21.846+00:00",{"slug":39,"title":40,"published_at":41},"aflac-japan-subsidiary-breach-exposes-customer-financial-and-policy-data","Aflac Japan Subsidiary Breach Exposes Customer Financial and Policy Data","2026-06-30T12:21:32.773+00:00",[43,48,53,57,62,66],{"slug":44,"name":45,"problem":46,"stories":47},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",5,{"slug":49,"name":50,"problem":51,"stories":52},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":54,"name":55,"problem":56,"stories":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":58,"name":59,"problem":60,"stories":61},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":63,"name":64,"problem":65,"stories":61},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"slug":67,"name":68,"problem":69,"stories":61},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[71,76,81,86,91,95,99,103],{"family":72,"item":73,"code":74,"title":75,"together":47},"cis","12","Control 12","Network Infrastructure Management",{"family":72,"item":77,"code":78,"title":79,"together":80},"13","Control 13","Network Monitoring and Defense",4,{"family":82,"item":83,"code":84,"title":85,"together":80},"nist-800-53","sc-7","SC-7","Boundary Protection",{"family":72,"item":87,"code":88,"title":89,"together":90},"3","Control 3","Data Protection",3,{"family":92,"item":93,"code":94,"title":94,"together":90},"itil","overview","ITIL",{"family":72,"item":96,"code":97,"title":98,"together":52},"6","Control 6","Access Control Management",{"family":72,"item":100,"code":101,"title":102,"together":52},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":72,"item":104,"code":105,"title":106,"together":52},"7","Control 7","Continuous Vulnerability Management"]