Skip to content
If you walked into your bank branch this morning, you likely passed through several layers of physical security without thinking about it. There’s the front door (accessible to everyone), the teller line (restricted to employees), the vault (highly restricted), and perhaps a safe deposit box area (customer-specific access). You wouldn’t leave the vault door wide open just because the front door is locked, right?
With their technology, however, many organizations do exactly that. They rely on a strong perimeter firewall—the digital front door—but once someone gets inside, they have free rein over the entire network. This is called a “flat network,” and for community banks holding sensitive financial data, it’s a significant risk.
Network segmentation is the digital equivalent of that bank vault. It’s about creating internal barriers that stop a cybercriminal from moving freely if they manage to slip past your outer defenses.
What Is Network Segmentation?
At its simplest, network segmentation involves dividing a larger computer network into smaller sub-networks, or segments. These segments act as distinct zones, separated by firewalls or other security controls that dictate who—and what—can cross the border between them.
Think of it like a submarine. If the hull is breached, watertight doors seal off the flooded compartment to keep the rest of the ship afloat. In a segmented network, if a hacker compromises a single workstation in the marketing department, segmentation prevents them from jumping straight into the core banking system or the wire transfer server.
Why Segmentation Matters for Community Banks
Community banks are in a unique position. You possess the same high-value data as global financial institutions—Social Security numbers, loan documents, and account balances—but often operate with leaner IT teams.
In a flat network architecture, a single phishing email clicked by a loan officer could potentially give an attacker a direct line to your domain controller. Once they have those credentials, they own the network.
Network segmentation breaks this chain of attack. By isolating critical assets, you contain the threat. Even if an attacker gets in, they are trapped in a low-value zone with no easy path to your “crown jewels.”
FFIEC Expectations and Compliance
Beyond common sense security, segmentation is a regulatory expectation. The Federal Financial Institutions Examination Council (FFIEC) Information Security Booklet discusses the need for network controls.
Examiners expect banks to:
- Establish security zones based on risk levels.
- Maintain accurate network diagrams and data flow charts.
- Implement defense-in-depth strategies (acknowledging that a perimeter firewall isn’t enough).
- Enforce “least privilege,” meaning systems should only talk to each other if absolutely necessary.
Common Network Segments to Consider
Deciding how to slice up your network can be daunting. You don’t want to overcomplicate things, but you need enough separation to be effective. Here is a standard approach many community banks adopt to categorize their zones.
High-Risk / Restricted Zones
This is your digital vault. This zone should house your most critical assets, such as:
- Core banking servers
- Wire transfer systems
- ATM switches
- Swift terminals
Access to this zone should be tightly controlled. Only specific administrators and necessary services should be allowed in, and every connection should be logged and monitored.
External-Facing Zones (DMZ)
If your bank hosts its own website, email servers, or customer portals, these belong in a “Demilitarized Zone” or DMZ. These systems must talk to the public internet, which makes them inherently riskier. By isolating them in a DMZ, you ensure that if a web server is hacked, the attacker doesn’t automatically have access to the internal employee network.
General Operations Zones
This is where the day-to-day work happens. This segment typically includes:
- Employee workstations (tellers, loan officers, back office)
- Internal printers
- General file shares
While important, these devices are high-probability targets for phishing and malware. They should not have direct, unfettered access to the High-Risk/Restricted Zone.
Isolated/Untrusted Zones
Some things just don’t belong on the main network at all. This includes:
- Guest Wi-Fi: Visitors should never be on the same network as your business operations.
- IoT Devices: Smart thermostats, security cameras, and vending machines are notoriously insecure. Isolate them completely.
- Vendor Access: If a third-party vendor needs remote access for HVAC maintenance, give them a specific, isolated path that goes nowhere else.
Controls That Make Segmentation Work
Drawing lines on a whiteboard is easy; enforcing them technically requires specific controls.
Perimeter Controls
Firewalls, proxies, and gateways sit at the edge of each segment. They inspect traffic trying to enter or leave a zone and apply rules (e.g., “Allow the teller workstation to access the core banking app on Port 443, but block everything else”).
Internal Controls
Inside the network, you use technologies like VLANs (Virtual Local Area Networks) to logically separate traffic even if it’s running on the same physical cables. Access Control Lists (ACLs) on your switches act as traffic cops, permitting or denying packets based on IP addresses.
For administrative access to sensitive zones, consider using “jump servers.” Administrators must first log into this highly monitored intermediary server before they can access the critical systems, adding an extra layer of authentication and logging.
Detection Controls
Segmentation isn’t just about blocking; it’s about seeing. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) should be placed at the boundaries of your segments. Since legitimate traffic between zones should be predictable, any anomaly (like a printer trying to talk to a wire server) stands out immediately, allowing you to catch threats faster.
How to Get Started
Implementing network segmentation doesn’t happen overnight. It requires planning to avoid disrupting bank operations.
- Assess Your Architecture: You can’t protect what you don’t know. Start with a comprehensive asset inventory.
- Classify Your Assets: Label every server, application, and device based on risk and sensitivity. Does it hold customer PII? Does it move money?
- Define Your Policies: Determine who actually needs access to what. Does the marketing team need access to the loan processing server? Probably not.
- Implement and Monitor: Roll out changes in phases. Start by monitoring traffic to ensure you understand the data flows, then slowly turn on the blocking rules.
Common Mistakes to Avoid
While network segmentation is powerful, it can be tricky. Here are a few pitfalls to watch out for:
- Over-segmenting: Creating too many tiny zones can make the network unmanageable and slow down legitimate business processes. Aim for a balance between security and usability.
- Neglecting Network Diagrams: If your IT team doesn’t have an up-to-date map of the segments, they can’t troubleshoot issues or spot security gaps.
- Relying Solely on the Perimeter: Don’t fall into the trap of thinking a strong firewall at the edge means you don’t need internal barriers. The “hard crunchy shell, soft chewy center” model of security is obsolete.
Next Steps for Your Bank With RESULTS Technology
Network segmentation is an effective way to reduce your bank’s attack surface and limit the blast radius of a potential breach. It turns a potential catastrophe into a manageable incident.
If you aren’t sure where your current architecture stands, now is the time to pull out those network diagrams and start asking questions. A secure network is a segmented network.
The community bank IT experts at RESULTS Technology can help you assess your network segmentation and ensure that critical systems are separate from the rest of the network. Schedule a call with us to get all of your banking IT questions answered!
