From grimoire
Guides network segmentation design using NIST and CIS controls to isolate sensitive data, achieve PCI DSS/HIPAA compliance, and limit breach blast radius with VPC/subnet isolation, security groups, NACLs, and bastion hosts.
How this skill is triggered — by the user, by Claude, or both
Slash command
/grimoire:design-network-segmentationThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Partition networks into isolated zones so that a compromised segment cannot pivot laterally to compromise others.
Partition networks into isolated zones so that a compromised segment cannot pivot laterally to compromise others.
Adopted by: PCI DSS mandates it for cardholder data environments; HIPAA requires it for ePHI isolation; DoD mandates zero-trust segmentation; every major financial institution Impact: Reduces breach blast radius by 60-80% (IBM Cost of a Data Breach 2023); PCI DSS compliance requires segmentation to reduce audit scope; lateral movement limited to compromised segment Why best: Flat networks allow attackers who breach any host to reach all hosts; segmentation enforces least-privilege at the network layer and contains compromise
Sources: NIST SP 800-125B (2016); CIS Controls v8 Control 12 (2021); PCI DSS v4.0 (2022)
Identify and classify assets — Inventory all systems and classify by data sensitivity (public, internal, confidential, restricted) and function (web tier, app tier, database, management). This classification drives segment boundaries.
Define security zones — Establish standard zones: DMZ (public-facing services), application tier, database tier, management/bastion, and DevOps CI/CD. Each zone has a defined trust level and allowed traffic flows.
Apply the principle of least-privilege to network flows — Define an allowlist of required traffic flows between zones. Default-deny all other traffic. Document every allowed flow with business justification. Deny-by-default is the foundational rule.
Implement VPC/VNET segmentation — Use cloud-native constructs: separate VPCs per environment (dev, staging, prod) and per security domain. Use VPC peering or Transit Gateway only for explicitly needed cross-VPC flows. Never peer dev VPC to prod.
Deploy security groups and NACLs — Security groups: stateful, applied at instance level, source/destination specific. NACLs: stateless, applied at subnet level, for subnet-boundary enforcement. Layer both; NACLs catch security group misconfigurations.
Isolate database tier — Database subnets must have no route to the internet (no NAT gateway, no IGW). Access only from application tier security group. Deny direct admin access; route through bastion host with session recording.
Implement a dedicated management zone — All administrative access (SSH, RDP, kubectl, cloud console) flows through a hardened bastion/jump host or VPN. The management zone has no internet access. Log all sessions with tools like AWS Systems Manager Session Manager.
Design micro-segmentation for critical workloads — For PCI or highly sensitive data: implement host-based firewall rules (iptables, Windows Firewall, Calico for Kubernetes) to restrict east-west traffic within a subnet. Service mesh (Istio) provides mTLS between services.
Validate with traffic flow analysis — Use VPC Flow Logs (AWS), Cloud Flow Logs (GCP), or NSG Flow Logs (Azure) to verify only allowed traffic flows exist. Scan for unexpected cross-segment flows. Run this analysis after every architecture change.
Document and review segment topology — Maintain a network diagram showing all segments, routing, and firewall rules. Review quarterly and after major changes. Treat undocumented traffic flows as security findings.
0.0.0.0/0 on port 443 in internal segments; specify exact source security groups, not CIDR ranges.npx claudepluginhub jeffreytse/grimoire --plugin grimoireDesign and implement network segmentation to limit lateral movement and contain breaches.
Designs VPC network segmentation with public/private/data subnets, VPC endpoints, and security groups to contain blast radius and prevent lateral movement.
Designs network segmentation with firewall zones, VLANs, ACLs, and microsegmentation to restrict lateral movement and enforce least-privilege access.