What security advantage does the utilization of a switch as opposed to a hub offer for a secure network design?

Physical cable separation is a physical security measure unrelated to the logical per-port traffic isolation that switches provide compared to hubs.

Unlike hubs, which broadcast every frame to all connected ports, switches maintain MAC address tables and deliver frames only to the port of the intended recipient. This means a compromised system on a switched network cannot passively sniff traffic destined for other hosts, significantly reducing the risk of credential theft and data interception via promiscuous-mode packet capture.

IDS/IPS deployment complexity is not determined by switch versus hub topology; both environments require port mirroring (SPAN) or inline taps to capture traffic for inspection.

Switches operate at Layer 2 and have no bearing on host-based firewalls, which protect individual systems from unauthorized connections independently of the underlying network device type.