A financial services company runs a multi-tier application (web, application, and database tiers) across many virtual machines in a single IaaS virtual network. During a tabletop exercise, the security team notes that if any single web-tier VM is compromised, an attacker could freely reach the database VMs because all internal traffic between VMs is currently unrestricted. Perimeter firewalls only inspect north-south (ingress/egress) traffic. Which control best reduces the risk of lateral (east-west) movement between the tiers?