Zero Trust and segmentation
Cube Cyber designs and implements Zero Trust architecture and network segmentation for Australian organisations, containing a breach instead of assuming one will never happen. From macro-segmentation between corporate and operational networks to host-level microsegmentation, we deliver the design, the implementation and the validation, in environments where the segmentation has to work around live clinical, financial and industrial systems.
Talk To Us About Segmentation
Segmentation programs start from problems most organisations will recognise:
Segmentation belongs near the top of the roadmap when the environment is flat and carries assets that matter, and it becomes urgent after a near miss, before a cyber insurance renewal that asks hard questions about lateral movement, or when obligations such as SOCI, APRA expectations or IEC 62443 require demonstrable separation. It is also the control that most changes the economics of every future incident: contained events are measured in days and thousands, uncontained ones in months and millions.
Core capabilities & deliverables
Segmentation strategy and design
A segmentation model built from how your environment actually communicates, application dependencies, data flows and administrative access, with zones, conduits and policy defined at the level your operations can sustain. Design first, technology second.
Application dependency mapping
Before anything is enforced, we establish what actually talks to what, the discovery phase that failed segmentation projects skipped. This is where imagined architecture meets real traffic, and where enforcement without disruption becomes possible.
Microsegmentation delivery
Host-level segmentation designed and implemented at scale, including as an Illumio Core Expert partner, ring-fencing critical applications, isolating backups and separating management planes, with policy built from observed flows and enforced progressively.
IT/OT segmentation
Separation between corporate and operational networks aligned to IEC 62443 zones and conduits, so a compromise that starts with a phishing email cannot reach the systems running production, patient care or building plant.
Identity-centred access
Zero Trust is as much identity as network. We design conditional access, privileged access and authentication architecture so access decisions consider who, what, from where and in what state, aligned to ASD Essential Eight maturity targets.
Validation and evidence
Segmentation that is claimed but never tested is a hope, not a control. We validate enforcement through structured testing, our Security Testing practice can independently verify, and produce the evidence auditors and regulators ask for.
Segmentation engagements follow four stages, sequenced so operations never take the risk:
Discover and map
Application dependency mapping and traffic analysis to establish real communication patterns, including the undocumented integrations that break naive designs.
Design
Zones, conduits and policy models matched to risk and operational reality, with critical assets, backups, management planes, OT boundaries, ring-fenced first.
Implement progressively
Policy deployed in monitor mode, tuned against real traffic, then enforced in stages, so containment arrives without outages, and rollback is always available.
Validate and operate
Enforcement tested, evidence produced, and the operating model handed over, including how policy changes happen after we leave, because segmentation decays without ownership.
Designs align to Zero Trust principles as described by NIST SP 800-207, the ASD Essential Eight and ISM, ISO 27001 control objectives, and IEC 62443 for operational environments. We work across the network, identity and workload technologies our clients already run, including our partnerships with Illumio, Cisco, Fortinet and Microsoft.
NISTISO 27001IEC 62443Frequently asked questions
Zero Trust means no user, device or network location is trusted by default, every access is verified against identity, device state and policy, and the network is built so compromise in one place cannot spread everywhere. In practice it is delivered through segmentation, identity controls and continuous verification, engineering, not a product you can buy in one box.
Not if the discovery is done properly, which is exactly the phase we refuse to skip. Application dependency mapping establishes real communication patterns first, policy runs in monitor mode before anything is enforced, and enforcement is staged with rollback available. The projects that break applications are the ones that guessed.
Microsegmentation enforces policy at the workload or host level rather than only at network boundaries, ring-fencing individual applications and stopping lateral movement inside a zone. You need it where the assets justify it: crown-jewel applications, backup infrastructure, management planes and regulated data environments are where it pays for itself first.
Initial containment of the highest-risk paths, isolating backups, separating management access, ring-fencing a critical application, can land within weeks. Full programs are staged over months, sequenced so each stage delivers standalone risk reduction. We scope to the environment rather than selling a fixed program.
The principles apply, the tooling often does not. OT segmentation follows IEC 62443 zones and conduits, uses methods that respect availability constraints, and relies on compensating controls where devices cannot run agents or be modified. With more than 10 years' experience in OT, we design for those constraints rather than around them.
It is the start of one. VLANs and zone firewalls provide macro-segmentation, and their value depends entirely on the policy between zones, which in most environments has accumulated exceptions for years. Effective segmentation is measured by what an attacker can reach from a compromised host, not by how many zones the diagram shows, and that is the measure we design and validate against.
We're here to help.
Talk to a practitioner, not a call centre. Tell us what you're trying to solve and we'll come back to you within one business day. If you're dealing with an active incident, call us directly.
Send us a message
Tell us what you're trying to solve and we'll get back to you within one business day.
We use the details you provide to respond to your enquiry. Your information is stored in our Microsoft 365 environment and handled in line with our Privacy Policy, which explains how to access or correct it and how to make a complaint.