Skip to content

Segmentation or Quarantine Switch

Isolation control — instantiates Spanning Connectivity Formation

Stands ready to cut selected links or wall off regions the moment newly-formed connectivity starts carrying something harmful, containing the spread without tearing down the whole network.

Every other mechanism in this set adds or maintains connectivity; Segmentation or Quarantine Switch removes it — fast, selectively, and on purpose. Connectivity is double-edged: the same paths that carry value carry contagion, whether malware, disease, fraud, or a cascading failure. The switch is a pre-built, fast-acting isolation control that trades reachability for containment on demand and then rolls back when the threat is gone. Its defining property is that it is armed and waiting: the value is in being ready to sever the right links instantly, which is why the cuts and firebreaks must be planned before the emergency, not improvised during it. It is the guardrail that makes aggressive connectivity-formation safe to attempt in the first place.

Example

An enterprise has spent years flattening its sites into one well-connected network for easy access. At 2 a.m. ransomware begins encrypting hosts and spreading laterally across exactly those links. The segmentation switch is a set of pre-defined isolation zones and a one-action control that severs the inter-segment links, quarantining the infected subnet so the worm cannot reach the rest of the estate. A firebreak plan says which segments to sacrifice to protect the core systems. Once the infection is contained and cleaned, a rollback path restores the links segment by segment, verifying each is clean before reconnecting. The outbreak is boxed into one zone instead of taking the whole company — the connectivity was bounded, not abandoned.

How it works

  • Pre-define the boundaries. The isolation zones and firebreaks are drawn before the incident; a switch you have to design mid-crisis is not a switch.
  • Trip on a propagation signal. It consumes a detector's alarm rather than building one, then acts — its job is the cut, not the diagnosis.
  • Sever the minimum containing set. Cut the fewest links that stop the spread while preserving the most remaining connectivity.
  • Hold a rollback path. Keep a planned, verified route back to full connectivity once the threat is contained, so isolation stays temporary.

Tuning parameters

  • Trip sensitivity — hair-trigger (contains more, more false alarms and lost connectivity) versus deliberate (fewer false cuts, more spread allowed through).
  • Cut granularity — link, segment, or whole region; finer granularity preserves more connectivity but is harder to pre-wire.
  • Automation — manual authorization versus auto-trip: speed against the risk of an automated cut firing on a false positive.
  • Firebreak depth — how large a containment ring to drop; wider is safer but strands more of the network.
  • Rollback caution — reconnect fast (risking re-ignition) versus staged verification of each restored segment.

When it helps, and when it misleads

Its strength is making bold connectivity survivable: you can afford to connect aggressively precisely because you can isolate instantly, bounding the blast radius of anything that spreads.[1] Its failure mode is over-use — leaving segments permanently walled off "to be safe" quietly destroys the connectivity the rest of the archetype worked to build, and re-fragments the very network that was so expensive to form. The classic misuse is tripping quarantine to look decisive during an incident that did not need it, or to cover a problem, and then never rolling back. The discipline is to pair every cut with a rollback trigger and a review, so isolation is always temporary containment and never permanent fragmentation.

How it implements the components

Segmentation or Quarantine Switch fills the safety-and-containment side of the archetype's machinery — the components that keep new connectivity from carrying harm:

  • unwanted_propagation_guardrail — it is the guardrail: the armed control that halts harmful spread across newly-enabled links.
  • contagion_firebreak_plan — the pre-defined firebreaks and sacrifice-zones it trips along to contain a spread.
  • rollback_path — the planned, verified route back to full connectivity once the threat is contained.

It does not detect or monitor the spread in the first place (Giant-Component Dashboard and external detectors), build the connectivity it protects (candidate_activation_set — Link-Activation Program), or harden the topology so loss is survivable (Cut-Set Hardening).

Notes

This is the one mechanism in the set whose action reduces connectivity, which can read as working against the archetype's purpose. It does the opposite: because the switch exists, a team can afford to form connectivity aggressively, knowing harmful spread can be contained. That only holds if the switch is temporary by design — an isolation that is never rolled back has simply undone the connectivity work, not protected it.

References

[1] Blast radius — the extent of what a single compromise or failure can reach before it is contained. Segmentation is the standard way to bound it; the goal is to cap the blast radius, not to minimize connectivity for its own sake. ↩