Segmentation Gap Behind a 'Compliant' PCI Boundary
A retailer's cardholder data environment (CDE) is a /24 VLAN with a firewall between it and the corporate LAN. The firewall ACL permits the corporate /16 to reach the CDE on 443, 445, and 3389 'for admin support.' A quarterly internal scan of the CDE finds one unpatched Windows host (MS17-010-class SMB vulnerability) and a domain-joined jump box. The corporate /16 contains 3,000 workstations, including a marketing subnet with no EDR. The security team argues the CDE 'passes segmentation' because the scan scope is limited to the CDE /24 and no criticals were reported on internet-facing assets. An assessor flags the design. Management asks whether the finding is real or paperwork.
1. Is the segmentation control effective? Reason about the trust relationship created by the ACL.
Read the worked answer
No. Segmentation is only effective if a compromise on the less-trusted side cannot reach the CDE. Allowing the entire corporate /16 to reach SMB (445) and RDP (3389) means any of 3,000 workstations - including an unmonitored marketing subnet - is a viable pivot into the CDE. Combined with an SMB-vulnerable host in the CDE and a domain-joined jump box, a single workstation compromise yields lateral movement into cardholder systems. The 'passes segmentation' argument conflates scan scope with blast radius: scoping the scan to /24 describes what was scanned, not what is reachable. The finding is real.
2. Propose a target-state design and the evidence you would collect to prove the control works, not just that it is documented.
Read the worked answer
Target state: remove broad /16 access; permit only named admin hosts via a managed jump host with MFA, restrict CDE ingress to required ports (drop 445/3389 from workstations), and segment admin traffic on its own VLAN. Evidence: (1) firewall rule review showing no any-/16-to-CDE paths; (2) an actual reachability test from a marketing workstation proving 445/3389/443 to CDE are denied; (3) jump-host logs showing all admin sessions brokered and MFA'd; (4) patch status of the SMB host. The key is adversarial evidence - a test that attempts the pivot and fails - rather than an ACL screenshot, because ACLs drift and documentation lags configuration.