Dividing a network into separate zones so a breach in one area can't automatically spread to every other system.