Network Security Architecture & Segmentation in India.
Defensive network engineering — segmentation strategy, firewall rule-base reviews, SASE / ZTNA design, OT-IT boundary architecture and microsegmentation roadmaps that survive procurement and the change-advisory-board. Distinct from our network-pentesting service: this is design and review, not exploitation.
What is network security architecture?
Network security architecture designs how your networks are segmented, monitored, and defended — spanning firewalls, SASE/ZTNA, and OT zoning — so a breach in one area can't spread. Macksofy designs and reviews architectures to IEC 62443 and Zero Trust principles for enterprises and industrial operators across India.
Segmentation strategy, firewall rule-base cleanup, SASE and ZTNA design, OT boundary architecture and a microsegmentation roadmap. Nothing here is exploited — the output is drawings, rule changes and a rollout plan.
The offensive counterpart. Many clients buy both — the pentest is what validates that the architecture work actually holds, rather than that it looks right on a diagram.
See the offensive serviceTwelve thousand rules, half of them fiction.
Networks accrete. Two acquisitions later the rule base carries comments like “temporary — 2018”, and nobody will touch it because nobody can prove what breaks. Proving that is the first deliverable.
- Eliminate flat-network lateral movement during incidents
- Pass RBI / SEBI / ISO / PCI segmentation evidence asks
- Cut firewall change-failure rate; recover engineering velocity
- Reduce attack surface visible to compromised endpoints
- Future-proof against board-level ransomware scenario asks
No hits in the log-retention window. Object references point at hosts decommissioned years ago.
Never evaluated — an earlier, broader rule always matches first. Removing them changes nothing except the review burden.
ANY on a source, destination or service. Usually the ones commented “temporary” with a date several years in the past.
Kept, tightened where the observed flows are narrower than the rule that permits them.
Rollback-tested, rule by rule · every removal ships with a change window and a tested rollback. That is why the outage count above is zero, and it is the part that makes the change-advisory board say yes.
Zones you can actually get to from here.
Every segmentation deck contains a beautiful target state. The useful question is whether there is a sequence of change windows that reaches it without a Saturday-night outage.
Reachable from the BYOD VLAN
Isolated, jump-host only, admin sessions recorded
Sandbox environments can route to it
Scoped CDE with a documented boundary the QSA can walk
Engineering laptops share a VLAN with the historian
IEC 62443 zones and conduits, dedicated realm, brokered access
Legacy jump-host permits inbound SMB
Single-direction publishing, no inbound path to internal
Flat east-west, any workstation to any server
Microsegmented by application, default-deny between tiers
On the corporate VLAN with a shared PSK
Brokered through ZTNA, per-session and per-application
The target column is only useful if it can be reached from the left one on a real change calendar. Every zone ships with a phased rollout, documented exceptions and the change windows to get there.
Four lines where the audit lands.
IEC 62443-3-2 zones and conduits, against the practical realities of Indian manufacturing — legacy PLCs, vendor-mandated flat networks and engineering-laptop hygiene.
CDE scoping memo the QSA can walk end to end, with everything that touches it either in scope deliberately or segmented out provably.
The zone that decides whether an incident is contained or total. Reachability is proved rather than assumed, in both directions.
ZTNA design for third parties and remote sites, replacing the flat VPN that currently lands them next to production.
Discovery is passive before it is active.
NetFlow and span ports first, no agents required — so the topology map reflects what actually talks to what, not what the CMDB believes.
- ▸Passive discovery (NetFlow, sFlow, span ports) — no agents required
- ▸Active discovery where allowed (Nmap, Forescout, native cloud)
- ▸Trust-zone classification — tier-0 / OT / PCI / DMZ / corporate
- ▸Crown-jewel mapping with business + data-flow owners
- ▸Multi-vendor rule analysis (Palo Alto, Check Point, Fortinet, Cisco, Juniper)
- ▸Dead rule + shadowed rule + overly-permissive rule identification
- ▸Object cleanup + zone-based rebase plan
- ▸Risk-ranked rule-by-rule remediation with rollback windows
- ▸Target-state segmentation map per trust zone
- ▸OT / ICS demarcation per IEC 62443-3-2 zones & conduits
- ▸PCI cardholder-data-environment boundary memo
- ▸Vendor-network and BYOD isolation design
- ▸SASE vendor short-list (Zscaler, Netskope, Cisco, Palo Alto Prisma)
- ▸ZTNA design for remote + branch + third-party
- ▸Microsegmentation tool short-list (Illumio, Akamai Guardicore, NSX, native cloud)
- ▸Phased rollout plan that survives a 12-month CAB calendar
- ▸Regulator-mapped segmentation evidence pack (RBI / SEBI / ISO / PCI)
- ▸Network architecture diagram suite — current vs target
- ▸Change-management playbook + rollback-tested templates
- ▸Optional 90-day quarterly drift audit (retainer)
Three estates. Zero outages.
Scope · 12,000-rule firewall cleanup + zone rebase
Finding · 47% rules dead or shadowed; tier-0 reachable from BYOD VLAN
Rule count to 6,400 with zero outage; RBI inspection clean
Scope · IT-OT segmentation per IEC 62443
Finding · Engineering workstation in same VLAN as plant historian
Zone & conduit redesign; USFDA pre-approval inspection ready
Scope · PCI-DSS 1.x CDE scoping + microsegmentation pilot
Finding · CDE not properly isolated; sandbox env reachable from CDE
CDE blast radius reduced 80%; QSA pass on first attempt
Your estate is already four vendors deep.
Palo Alto, Check Point, Fortinet, Cisco ASA and FTD, Juniper SRX and the native cloud security groups. We do not resell firewall licences, which is what lets the short-list memo mean something.
Transparent tiers. No surprises at quote time.
Indicative price ranges based on typical Indian engagements. Final fixed-price quote within 72 hours of the discovery call.
Build
- Tooling (Wazuh / ELK / Splunk) implementation
- Baseline detection rules
- Runbook authoring
Operate
- Everything in Build
- 24×7 monitoring across business hours
- Monthly threat-hunt + posture reviews
Resilience
- Everything in Operate
- L3 threat hunters + IR retainer
- Annual table-top + DR drill
Note · Indicative pricing in INR. Setup + 12-month operate is the most-asked combination. Custom blends available.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Questions before the first diagram.
Where Macksofy delivers Network Security.
On-site engagements across India's BFSI, fintech, government and SaaS metros plus the UAE. Senior consultants fly from Mumbai BKC for kickoff, key reviews and exit briefings; remote weeks run through the rest of the engagement.
Macksofy delivers this work to the following standards and regulator requirements. Definitions and controls are sourced from the issuing bodies below.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements