What is Network Segmentation?

What Is Network Segmentation?

Network segmentation splits your network into smaller, isolated sections so sensitive data and systems are walled off from the rest of the environment. For payment security, it means drawing clear boundaries between the systems that handle card data and everything else on your network.

Think of a hospital where the operating theatres, the pharmacy, and the general wards are separated by secure doors with controlled access. Walk through the wrong door and you're stopped. Network segmentation works the same way — it limits the blast radius of any breach and keeps the sensitive areas off-limits.

How Network Segmentation Works

At the technical level, segmentation is a combination of firewalls, virtual LANs (VLANs), access-control lists, and routing rules. Together they create barriers between parts of the network, so traffic only flows where you've explicitly allowed it.

For a business taking card payments, the boundary that matters is the one around the Cardholder Data Environment (CDE) — the systems, networks, and processes that store, process, or transmit card data. Isolate the CDE properly and you can cut PCI DSS scope dramatically.

Without segmentation, every device on your network is potentially in PCI scope. Every laptop, printer, and server has to meet the standard's requirements — which is hugely expensive and, for most businesses, impractical.

Key Segmentation Approaches

• Physical segmentation uses entirely separate hardware — separate switches, routers, and cabling — for the CDE. Most secure, most expensive
• Logical segmentation uses VLANs, firewall rules, and software-defined networking to create virtual boundaries on shared hardware. More cost-effective, and the approach most organisations actually take
• Micro-segmentation goes further, applying granular controls at the individual workload or application level, usually with software-defined networking tools

Why Segmentation Matters for PCI DSS

PCI DSS doesn't strictly mandate segmentation, but it strongly recommends it — and for good reason. Without it, your whole network is in scope, which means every system has to meet every applicable requirement. The cost and ongoing effort of running PCI compliance across an unsegmented network is prohibitive for almost everyone.

Effective segmentation reduces scope by confining card data to a small, well-defined area. Fewer systems to secure, fewer to monitor, fewer to scan, simpler and cheaper audits. For most businesses, segmentation is the single biggest thing you can do to cut PCI workload.

Segmentation in Telephone Payment Environments

Contact centres face a particular problem with segmentation. The systems involved in a phone payment — agent workstations, telephony platform, call recording servers, CRM, payment terminal — are usually tightly connected to each other.

If card data passes through the voice channel (an agent hearing the customer read out the card number, for example), then the telephony kit, the agent's PC, and the recording system are all part of the CDE. You can segment them from the rest of the network, but it's messy and the controls are hard to keep working over time.

The cleaner approach is to stop card data entering the telephony environment at all. With DTMF masking, the digits get captured directly from the caller's keypad and routed straight to the payment processor — they never pass through the agent's environment. That takes the telephony systems out of the CDE and simplifies segmentation enormously.

Practical Considerations

Segmentation isn't set-and-forget. PCI DSS requires that segmentation controls are tested at least every six months (for service providers) or annually (for merchants). Network changes, new applications, and infrastructure updates can all break a segmentation boundary without anyone noticing.

• Document your network architecture properly, showing every segmentation boundary
• Test the segmentation controls with penetration testing on a regular cycle
• Review firewall rules and access-control lists periodically — drift is real
• Be cautious with network changes. A minor-looking update can quietly open a path into the CDE

The Future of Segmentation

As businesses move to cloud and hybrid infrastructure, traditional segmentation is changing. Software-defined networking and zero-trust architectures shift the model away from perimeter boundaries toward identity-based access controls that verify every connection, regardless of where it originates.

For contact centres specifically, cloud migration is making segmentation easier. Cloud telephony and payment platforms naturally separate functions into distinct services, each with its own security boundary. When the payment service runs in its own isolated cloud environment with its own PCI certification, the segmentation is baked into the architecture — not something the merchant has to configure and maintain.