Blast Radius and the Cost of a Reach
Faraday's read: security failures are geometry problems. The question is never only 'did they get in' — it's 'how far does one foothold travel.' A flat network is a building with no interior doors: kick in the front and you own every room. Segmentation, least privilege, and containment are just interior architecture — walls that make a breach a local event instead of a total one. You will not stop every intrusion; assume you can't. What you can decide, in advance and on purpose, is how much a single mistake is allowed to cost. Blast radius is a design choice, not an accident.
Knowledge check
Define blast radius, and explain how segmentation and least privilege each shrink it through a different mechanism.
Show the answer
Blast radius is the total extent of damage or access reachable from a single compromised point — how far one foothold spreads. Segmentation shrinks it by dividing the network into isolated zones with controlled crossings, so a breach in one zone cannot automatically reach the others (it limits where an attacker can go). Least privilege shrinks it by granting each account and system only the minimum access needed for its job, so a compromised credential unlocks little (it limits what an attacker can do). Together they ensure one reach yields a small, contained outcome rather than total control.