Layered Controls on a Legacy Build
Harbourline Financial has 600 endpoints, of which 180 run an operating system that stopped receiving vendor patches 14 months ago. The application that forces this is a mortgage origination system used by 40 staff; replacing it is funded but will take 18 months. Current controls: perimeter firewall, endpoint antivirus on 70% of machines (the rest failed deployment), full-disk encryption on laptops only, and a shared local administrator account for the branch network. Staff regularly email spreadsheets containing customer account numbers to personal webmail to work from home. A recent penetration test obtained domain administrator rights within two days by harvesting the shared local administrator credential from one workstation and reusing it across the estate. The board has approved a security programme but wants visible progress within one quarter.
1. Prioritise the remedial actions for the first quarter and justify the ordering.
Read the worked answer
Prioritise by reduction in likelihood of the most plausible severe event. The penetration test already demonstrated the path: harvest a shared credential, reuse it, own the domain. That path is live today and cheap to close, so it comes first.
Priority one: eliminate the shared local administrator account. Use a managed local administrator solution or unique per-machine passwords, and remove standing domain administrator rights in favour of just-in-time elevation. This is configuration and process work, achievable in weeks, and it breaks the exact attack chain the test proved. It also addresses the legacy systems, which cannot be patched but can be made harder to pivot from.
Priority two: complete endpoint protection deployment to the remaining 30%. An antivirus gap on 180 machines is a known, measurable deficiency and the rollout is already part-funded. Finish it, then report coverage as a metric.
Priority three: contain the legacy estate. The 180 unpatched endpoints cannot be fixed in the quarter, so compensate: network segmentation so the mortgage system and its users sit in a restricted zone, strict egress filtering, and application allow-listing on those machines. Document this as a time-bound risk acceptance tied to the 18-month replacement.
Priority four: stop the data leaving by email. This is a behaviour and control problem. Deploy data loss prevention or at minimum block webmail at the proxy, and give staff an approved remote-access route so the legitimate need is met. Without the alternative, blocking will simply be circumvented.
The ordering reflects effort versus risk reduction: cheap, high-impact configuration changes first; compensating controls around the irreducible legacy risk; and user-facing controls paired with an enabler.
2. The business argues that segmentation will disrupt factory-like branch workflows and asks to defer it until the replacement system arrives. How should security respond?
Read the worked answer
Security should not simply insist, because a control that breaks the business will be bypassed and will damage the credibility needed for the rest of the programme. Equally, it should not accept an 18-month deferral without conditions, because that leaves the proven attack path open for a year and a half.
The right response is to reframe the question from whether to segment to how much, and by when. Propose a phased segmentation: first isolate the legacy mortgage system and its 40 users from the general estate, which is a small, well-defined group and the least disruptive slice. Then extend to the wider branch network once the pattern is proven. Test in one branch, measure disruption, and adjust.
Attach compensating controls for the interim: restrict what the legacy segment can reach, monitor for credential reuse and unusual lateral movement, and ensure the shared administrator issue is fixed regardless, since that fix reduces risk whether or not segmentation proceeds.
Make the residual risk explicit and owned. If the business still chooses to defer after seeing the phased plan and the compensating controls, that is a legitimate decision - but it must be recorded as a formal acceptance by an accountable executive, with a review date and a stated trigger (for example, any further penetration-test finding on that path). Security's job is to make the consequence visible and to ensure the decision is made by someone with the authority to bear it, not to absorb it silently.
Finally, tie the whole thing to the funded replacement so the business sees segmentation as a bridge to the end state, not an extra burden.