The Undying Myths of Network Security

Every network has a few skeletons (or unmanaged assets) hiding in the proverbial closet. For some organizations, these little secrets are forgotten devices or a feeble switch near the end of its life. Other organizations struggle with less obvious, long-held network security myths that continue to knock from under the floorboards that act as the foundation of their security strategies.

These myths lurk inside various network security activities, from segmentation strategies to firewall rules. Network teams may assume their VLANs provide sufficient isolation or that an unpatchable device simply has to remain an accepted risk, until they experience the jump scare of a compromise. As networks become increasingly complex and interconnected, these lingering beliefs can create risks that allow attackers to move laterally (east-west traffic), access critical systems, or turn a single compromised device into a larger incident.

By uncovering these network security myths, network and security teams can understand why they no longer provide necessary protection and can remediate hidden risks.

Myth #1: Everything Behind the Firewall Is Safe

Before organizations adopted cloud-based technologies, traditional network security models focused on creating boundaries between external and internal networks. Where threats concentrated on external networks, the model trusted all users and devices inside the perimeter, assuming that they were relatively safe. Firewalls became the gatekeepers, inspecting and controlling north-south traffic as it entered and left the environment.

Today, firewalls are no longer the primary arbiters of trusted versus untrusted. Modern networks have many pathways into and across the network, including:

• Cloud services
• Remote users
• Third-party connected ecosystems
• Connected devices, like Internet of Things (IoT), operational technology (OT), and Internet of Medical Things (IoMT)

Attackers simply need to compromise one internal asset or obtain a set of legitimate credentials to overcome these perimeter defenses and pivot laterally without ever crossing a perimeter firewall. Modern network security strategies should consider that a malicious actor is always hiding in the network’s shadows.

Myth #2: VLANs Mean Segmentation Exists

A network security assumption that refuses to die is that VLANs effectively create segmentation. VLANs establish Layer 2 broadcast domains, enabling teams to organize devices, manage traffic, and create network boundaries.

However, simply placing devices on different VLANs isn’t enough if the core network automatically routes traffic between them. By default, most networks use inter-VLAN routing, which functionally makes these divides invisible to an attacker. Overly permissive firewall rules, poorly tuned access control lists (ACLs), a lack of routing isolation (like VRF instances), or missing identity-based microsegmentation (like Cisco Security Group Tags) can leave open pathways where systems should remain isolated.

Myth #3: All Networked Assets Are Known

Organizations can only protect the assets that they know they have, but many have unknown devices lingering in the network’s shadows. Traditional asset inventories often overlook unmanaged IoT devices, specialized OT and IoMT systems, legacy equipment, or devices that connect intermittently. They usually start as just an IP or MAC address, known at least to the authentication system that gives them network access, but with absolutely no other contextual information.

This shadow IT creates dangerous visibility gaps when teams use an incomplete inventory to make segmentation decisions. An unknown or misidentified device can be in the wrong network segment, retain unnecessary access to other systems, or create a pathway so attackers can move deeper into the environment. Furthermore, legacy active scanning tools cannot safely interrogate these environments without risking critical device failure; comprehensive discovery must also rely on passive telemetry.

Myth #4: Only a Patch Counts as Protection

An unpatchable vulnerability can feel like a specter haunting the network. Security and networking teams know that the risk exists, but they often have no practical way to exorcise it. Legacy, IoT, OT, and IoMT devices may run unsupported operating systems, require vendor-approved updates, or be too operationally critical to take offline for patching.

Without resolving these vulnerabilities, the organization still has a risk exposure. Segmentation can act as a compensating control by restricting device communications to only the systems and services they need, effectively neutralizing the specific MITRE ATT&CK behaviors required to exploit the CVE.

Myth #5: More Segmentation Means More Security

In theory, if some segmentation improves security, then more segmentation makes the network safer. Problematically, adding more rules and ACLs can lead to a maze of network boundaries while the riskiest communication path remains beneath the surface.

As the organization increases the number of segments, network and security teams must maintain more:

• Policies
• Firewall rules
• Access control lists
• Operational dependencies

When segmentation becomes too complex, security risk can get buried beneath policy sprawl, waiting to rise again. Physical hardware limits also come into play; excessive ACLs can cause TCAM memory exhaustion on network switches. Meanwhile, network teams may hesitate to change policies for fear of disrupting critical operations.

Myth #6: After Setting Rules, Segmentation Is Done

Segmentation policies have an unfortunate tendency to linger long after the network has changed. Over time, devices move, applications change, vulnerabilities emerge, and new business requirements alter which systems legitimately need to communicate.

Meanwhile, outdated firewall rules and ACLs can leave open unnecessary pathways or create exceptions that people forgot about. Those abandoned configurations can come back to haunt security teams when malicious actors discover connections that no one intended to keep available.

Myth #7: Zero Trust Means Locking Everything Down

Many organizations imagine a Zero Trust architecture (ZTA) as a phantom that blocks all connections until someone painstakingly approves a request. Teams managing critical devices and complex operational environments can find that prospect frightening enough to leave overly permissive access untouched.

Rather than preventing communications, ZTA ensures that users and devices only access the resources they need. When segmenting networks according to this strategy, teams must understand the legitimate communication patterns before they can restrict the unnecessary ones.

Instead of closing connections without insight, teams can use asset and network context to:

• Identify which devices communicate and with which other assets
• Determine the services and exact payload structures they depend on
• Locate excessively permissive access

How to Break Network Security Myths

Although it would be easier if saying “segmentation” three times into a mirror fixed all network security problems, breaking these myths requires security and network teams to replace inherited beliefs with information about how their environments actually operate.

When developing a modern segmentation strategy, organizations should focus on practices that help them uncover what is lurking in their environments without introducing new operational nightmares.

Maintain Continuous Asset Visibility

Continuous asset visibility helps organizations uncover the devices lurking across their IoT, OT, IoMT, and IT environments. Maintaining an accurate inventory gives security and network teams the context they need to make segmentation decisions based on the environment that actually exists rather than assumptions about what should be there.

When looking for a solution to help improve network security, organizations should ensure that it can:

• Automatically discover and inventory connected IoT, OT, IoMT, and IT devices without requiring agents. While traditional IT tools use disruptive active scans, the solution must be capable of providing specialized active scans where it makes sense. These surgical scans must be thoroughly tested not to interfere with sensitive environments, requiring a vendor that understands the specific nuances and protocols of the industry.
• Identify detailed device characteristics, including device type, manufacturer, model, operating system, and location.
• Continuously monitor the environment for new, unknown, or changing devices that could otherwise remain hidden from security teams.

Prioritize Devices Based on Risk

Risk-based prioritization helps teams focus segmentation efforts on the devices and communication pathways most likely to create meaningful security risk. Combining vulnerability information with device criticality and exploitability context helps organizations distinguish urgent exposures from vulnerabilities that may pose less immediate danger.

When looking for a solution to help improve network security, organizations should ensure that it can:

• Correlate device vulnerabilities with exploitability, threat intelligence, and asset criticality to prioritize remediation efforts.
• Identify high-risk devices that cannot be patched and recommend compensating controls that reduce their exposure.
• Continuously reassess device risk as vulnerabilities, threats, configurations, and network conditions change.

Build Segmentation Policies Around Device Communication

Understanding how devices normally communicate helps teams distinguish necessary connections from pathways that create unnecessary exposure. Using this context to develop segmentation policies can reduce opportunities for lateral movement without severing the connections that critical devices and business processes depend on.

When looking for a solution to help improve network security, organizations should ensure that it can:

• Analyze device communication patterns to identify the systems, services, protocols, and ports each asset requires.
• Recommend risk-based segmentation policies that restrict unnecessary communication while maintaining legitimate operational traffic.
• Integrate with existing network infrastructure, including firewalls and network access control (NAC) solutions, to help teams implement segmentation policies using their existing technology.
• PRO TIP: We’ve also seen devices that are polled according to calendar schedules, like usage polling for billing at the end of a month. Keep those dates in mind when evaluating traffic patterns.

Simulate Segmentation Policies Before Enforcement

Segmentation policy simulation enables teams to understand how proposed changes would affect network communications before enforcing them. Testing policies against actual device behavior helps teams uncover unintended consequences without learning about them when a critical system suddenly goes dark.

When looking for a solution to help improve network security, organizations should ensure that it can:

• Operate planned microsegmentation policies in an observation mode that restricts nothing to ensure operations but flags policy violations before they are live and enforced.
• Identify legitimate device communications that a proposed policy could inadvertently block or disrupt.
• Enable security and network teams to refine policies based on actual traffic before enforcing changes through existing network controls.

Stop Letting Network Security Myths Lurk in Your Environment

Asimily enables security and network teams to replace lingering assumptions with the asset, risk, and communication context they need to build effective segmentation strategies. By continuously discovering connected devices, prioritizing risk, analyzing communication patterns, recommending segmentation policies, and simulating their impact before enforcement, Asimily helps organizations reduce unnecessary attack paths without disrupting critical operations. With integrations across existing network security infrastructure, teams can turn these insights into enforceable controls while continuously adapting policies as their environments change. Instead of letting old network security myths dictate security decisions, organizations can use Asimily to build a risk-based, operationally resilient approach to network segmentation.