Segmenting a Ministry Network After a Lateral-Movement Incident
A ministry's flat /16 network connects 1,800 staff PCs, a public-facing web server, a payroll system, and a database holding citizen records. An incident review found that an attacker who compromised one staff PC reached the citizen database within 40 minutes. There is one perimeter firewall, no internal segmentation, shared local administrator passwords on all PCs, and domain admin accounts used for routine helpdesk work. The ministry must show remediation progress within 90 days but cannot replace the core payroll application, which requires flat access from staff PCs.
1. Prioritise the remediation actions for the 90-day window and justify the order.
Read the worked answer
Priority 1 - contain the highest-impact path. Segment the citizen database and web server from the staff VLAN using internal firewall rules allowing only the specific application flows. This directly addresses the observed 40-minute lateral movement and is achievable in 90 days without touching payroll.
Priority 2 - remove credential reuse. Replace the shared local administrator password with a managed per-machine local admin password solution. This breaks the single credential that likely enabled rapid spread.
Priority 3 - separate administrative accounts. Prohibit routine helpdesk use of domain admin; issue delegated, time-bound accounts. This limits blast radius even if a PC is compromised.
Priority 4 - logging and detection. Centralise authentication logs so future lateral movement is visible.
Justification. Actions are ordered by reduction of impact per unit effort against the observed attack path, not by generic best-practice lists. Payroll's flat-access requirement is an accepted, documented exception with compensating controls (host firewalling, monitoring), not a reason to abandon segmentation.
2. The payroll application cannot be re-architected. How should the exception be managed responsibly?
Read the worked answer
An exception should be explicit, scoped, owned, and reviewed - not silently accepted.
Scope. Define precisely which source ranges and ports payroll needs, rather than allowing the whole /16. A host firewall rule or a dedicated payroll VLAN with narrow rules is preferable to 'flat access'.
Compensating controls. Restrict payroll database access to the application service account; enable detailed logging on payroll traffic; apply prompt patching to payroll hosts; monitor for anomalous connections from staff subnets.
Ownership and review. Record the risk acceptance with a named owner, a review date (e.g. quarterly), and a trigger for revisiting (application replacement or vendor support change).
Reporting. State the residual risk honestly to management rather than reporting 'segmentation complete'. The judgement tested is recognising that a documented, narrow, monitored exception is defensible, whereas an undocumented flat network is not.