- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
The attacker was inside your network for eleven days before your team noticed. By then, they had traversed six VLANs, exfiltrated payroll records from an HR share, and planted a persistent backdoor on a domain controller. The breach notification letter cost more than the ransom would have. The root cause was not a missing patch or a weak password. It was a flat network.
This scenario plays out across Indian enterprises every quarter. Organisations that have invested heavily in perimeter security — FortiGate NGFWs, next-gen antivirus, even SIEM — still suffer massive lateral-movement incidents because their internal network offers almost no resistance once an attacker clears the front door. Microsegmentation changes that equation.
Traditional network segmentation divides infrastructure into broad zones: users, servers, DMZ. Microsegmentation goes further, applying security policy at the workload or application level so that a compromised device in one segment cannot freely communicate with anything else — even other hosts in the same VLAN.
Think of it as replacing one large open-plan office with a building full of locked rooms. An intruder who breaks into the break room cannot walk straight into the vault. Every door requires a different credential, and every movement is logged.
For Indian enterprises, microsegmentation is fast becoming a compliance expectation, not just a security best practice. The Digital Personal Data Protection (DPDP) Act, 2023 requires data fiduciaries to implement appropriate technical safeguards to prevent unauthorised access to personal data. A flat network where a compromised endpoint can reach customer databases is an indefensible posture under the Act. Similarly, the CERT-In Directions of 2022 require organisations to report incidents within six hours — and you cannot report accurately what you cannot isolate and observe.
Understanding how attackers exploit flat networks is the first step toward fixing them. The typical kill chain looks like this:
The critical observation is that steps two, three, and four depend entirely on unrestricted east-west traffic. Microsegmentation breaks this chain at steps two and three, even after the attacker has cleared the perimeter.
Implementing microsegmentation is an architectural project, not a point-product deployment. The following framework has been proven across mid-market and enterprise environments in India.
You cannot segment what you cannot see. Before writing a single firewall rule, spend two to four weeks passively capturing east-west traffic flows using your existing infrastructure. FortiGate’s built-in flow logging and application-layer visibility tools are well suited to this. The goal is a communication map: which workloads talk to which, on which ports, at what frequency.
Key questions to answer during discovery:
Based on the communication map, group workloads into logical zones aligned to business function and data sensitivity:
FortiGate NGFWs enforce microsegmentation through a combination of VLAN interfaces, inter-VLAN routing with explicit policy, and application-layer inspection. The key principles:
Once policies are live, use a purple-team exercise to validate containment. A simulated attacker starts from a compromised endpoint and attempts lateral movement. Document every step that the new segmentation blocks — and every path that remains open. Gaps found internally are far cheaper to close than gaps discovered during a real incident.
Organisations that have begun a Zero Trust Network Access (ZTNA) rollout sometimes ask whether microsegmentation is still necessary. The answer is yes — they solve different problems.
ZTNA controls access to applications: a user’s device is evaluated before being granted a session to a specific application, regardless of where the device sits physically. Microsegmentation controls east-west traffic between infrastructure components: even if two servers have network adjacency, they cannot communicate freely without an explicit policy permit.
A well-architected environment uses both: ZTNA at the application access layer and microsegmentation at the network infrastructure layer. Together, they provide defence in depth — a compromised ZTNA session is contained within its segment; a compromised host inside a segment cannot reach applications it has no ZTNA policy to access.
The DPDP Act requires data fiduciaries to implement technical and organisational measures to protect personal data. Microsegmentation directly supports several of those obligations:
Practical guidance: Map your DPDP data-flow register to your network segmentation design. Every system that processes personal data should sit in a dedicated segment with documented, policy-enforced inbound and outbound rules. This mapping becomes evidence of technical safeguards if your organisation is ever investigated.
Microsegmentation increases security, but it also increases operational complexity. When an application breaks because a new policy is too restrictive, your NOC needs to identify the blocked flow in seconds — not after a 20-minute trawl through distributed firewall logs. When a lateral-movement attempt is detected, your SOC needs the full attack storyline across segments on one screen, not stitched together from five separate dashboards.
This is the problem that the PrahiX Ora unified SecOps platform — which we deploy and operate for clients — is built to solve.
In segmented environments, log volume grows proportionally to the number of segments and the granularity of policy enforcement. Ora’s SIEM ingests event streams from all FortiGate segment boundaries simultaneously, applying MITRE ATT&CK-mapped correlation rules to surface lateral-movement patterns that individual firewall alerts would never reveal. Its graph-based attack storyline engine reconstructs the full movement chain — initial access workstation → compromised server → data tier — in a single visual, enabling your SOC analysts to understand the scope of an incident in minutes rather than hours. For Indian enterprises, tiered log retention (hot/cold/archive) helps evidence the 180-day in-country log retention direction from CERT-In without ballooning storage costs.
For NOC teams, Ora’s Network Management System (NMS) provides unified observability across the entire estate — FortiGate firewalls, switches, wireless APs, and SD-WAN links — regardless of vendor. LLDP/CDP topology discovery automatically builds the segment map so NOC engineers always have an accurate picture of what is connected where. ML-based anomaly detection flags unusual traffic patterns across segment boundaries (for example, a server that normally generates 2 MB/hour of inter-segment traffic suddenly generating 20 GB), triggering auto-healing policies before a human analyst needs to intervene. This is especially valuable for multi-vendor estates where NOC visibility is otherwise fragmented across disconnected element management systems.
For multi-site organisations in manufacturing, retail, and financial services, Ora’s video surveillance (VMS) capability brings physical and network security under one operations view. ONVIF, Hikvision, and Dahua cameras are managed alongside network infrastructure, with video analytics surfacing physical-security events in the same operational console as network anomalies — because a physical intrusion and a network intrusion are often the same incident viewed from two different angles.
Finally, when a suspicious lateral-movement event is confirmed, Ora’s SOAR engine takes the response actions that your team would otherwise execute manually. Pre-built connectors push blocklists directly to FortiGate at the policy enforcement point — isolating a compromised host or blocking a malicious destination before the analyst has finished writing up their initial assessment. For organisations subject to CERT-In’s 6-hour incident reporting window, this automation is what makes that timeline realistic: the platform contains, evidence-gathers, and drafts the notification context while your team focuses on the investigation.
If you are planning a microsegmentation project and want visibility and automation built in from day one, speak to our team about how we deploy and operate Ora for clients.
Microsegmentation projects fail for predictable reasons. Awareness of these pitfalls will save you months of rework:
Here is a pragmatic phased plan that has worked across mid-market and enterprise deployments:
PJ Networks has designed and deployed microsegmentation architectures across Indian enterprises in banking, manufacturing, healthcare, and IT services. Our approach combines FortiGate’s native segmentation capabilities with our 24/7 NOC/SOC for continuous policy management and incident response.
Our engagements typically include:
If your network is still largely flat — or if you have VLAN segmentation but no enforcement policy between zones — the question is not whether you will face a lateral-movement incident, but when. The cost of a proactive segmentation project is a fraction of a single breach notification process.
To discuss a microsegmentation assessment for your environment, contact the PJ Networks team. We will walk you through what your current east-west traffic looks like and what a segmented architecture would mean for your risk posture and compliance obligations.