Simulation-Based Validation of a Low-Cost Open-Source Micro-Segmentation Framework for Zero-Trust Lite Implementation in SMEs: Efficacy, Overhead, and Practical Considerations

Abstract

Small and medium enterprises (SMEs) often avoid micro-segmentation due to perceived high cost, complexity, and performance overhead, despite segmentation being a core zero-trust principle. This study evaluates whether a low-cost, open-source micro-segmentation framework can effectively contain lateral movement and reduce blast radius in an SME environment. A simulated SME network was built in GNS3 with VMware-based hosts, comprising 24 nodes in a flat baseline topology with no internal segmentation. A micro-segmented architecture was then deployed using pfSense firewalls, Zeek for network monitoring, OpenDaylight SDN controller, and default-deny access control lists (ACLs). In both scenarios, an attacker-controlled “Patient Zero” node attempted reconnaissance and lateral movement toward a Finance Server. Measurements included reachable nodes, successful lateral moves, time to compromise, internal traffic visibility, blast radius, latency, throughput, and implementation cost. Results show a 91.7% reduction in reachable nodes (from 24 to 2), a 94.4% decrease in lateral moves (from 18 to 1), and time to compromise extended from 14 minutes to over 185 minutes (an increase of 1,221%). Blast radius dropped by 92%, latency increased by only 0.6ms, throughput remained at 94% of baseline, and internal traffic visibility rose from 5% to 98% with zero false negatives. Total software cost was $0 using open-source tools, requiring 24 professional hours on repurposed hardware. These findings indicate that a “Zero-Trust Lite” posture is technically and economically feasible for SMEs.