  Micro-segmentation is an emerging security technique that separates physical
networks into isolated logical micro-segments (workloads). By tying
fine-grained security policies to individual workloads, it limits the
attacker's ability to move laterally through the network, even after
infiltrating the perimeter defences. While micro-segmentation is proved to be
effective for shrinking enterprise networks attack surface, its impact
assessment is almost absent in the literature. This research is dedicated to
developing an analytical framework to characterise and quantify the
effectiveness of micro-segmentation on enhancing networks security. We rely on
a twofold graph-feature based framework of the network connectivity and attack
graphs to evaluate the network exposure and robustness, respectively. While the
former assesses the network assets connectedness, reachability and centrality,
the latter depicts the ability of the network to resist goal-oriented
attackers. Tracking the variations of formulated metrics values post the
deployment of micro-segmentation reveals exposure reduction and robustness
improvement in the range of 60% - 90%.
