Zero-Trust Segmentation for a Mixed-Use Office
A 400-person office has one flat VLAN for all users, a separate voice VLAN, and a management VLAN. Contractors, employees, and a small IoT fleet (badge readers, HVAC controllers, printers) share the user VLAN. A recent audit flagged that a compromised laptop could reach the badge-reader subnet, and that contractors can reach internal file servers. The security team proposes 802.1X with dynamic VLAN assignment for employees and contractors, plus a separate IoT VLAN with ACLs. The network team notes that badge readers are unmanaged, do not support 802.1X, and are on a shared switch with user ports.
1. Design a segmentation approach that handles the unmanaged IoT devices without leaving user ports open to them.
Read the worked answer
Use a hybrid model. For managed endpoints (employees, contractors), deploy 802.1X with EAP-TLS and dynamic VLAN assignment; MAB fallback for devices that cannot authenticate. For unmanaged IoT, do not rely on 802.1X. Instead, assign IoT ports to a dedicated VLAN statically by port, and enforce ACLs at the distribution layer that permit only the specific flows the devices need (e.g., badge readers to the access-control server on TCP 443, HVAC to the building-management server).
The key risk is a user port being repurposed for an IoT device or vice versa. Mitigate with port profiles tied to switch port descriptions and a change-control process, plus MAC address allow-listing on IoT ports (sticky MAC) so an unauthorized device cannot join the IoT VLAN.
Do not place IoT on the user VLAN even with ACLs; shared broadcast domains undermine the segmentation goal. If port count is tight, use a small dedicated IoT switch per floor.
2. Contractors need access to a specific file server but should not reach other internal resources. How should the policy be expressed and enforced?
Read the worked answer
Express the policy as a least-privilege rule: contractors may reach the file server's IP on required ports only, and nothing else. Enforce it at the most effective point: the distribution switch or a firewall between contractor VLAN and server VLAN, not on the access switch (where ACLs are harder to audit and can be bypassed by VLAN hopping if trunking is misconfigured).
Implementation: put contractors in their own VLAN via 802.1X identity, then apply an inter-VLAN ACL or firewall policy permitting contractor-to-server traffic and denying contractor-to-other-internal-subnets, with logging on denies. If the file server is reachable via a load balancer, allow the VIP, not the backend pool.
Also consider that contractors may need internet access; permit that explicitly. Review the rule quarterly and tie it to the contractor's engagement dates so access is removed when the contract ends.
3. What monitoring and validation would you put in place to confirm the segmentation works and does not break clinical or building operations?
Read the worked answer
Validation should be continuous, not a one-time test. Deploy flow telemetry (NetFlow or sFlow) on the distribution uplinks and alert on any traffic between IoT and user VLANs, or between contractor and internal subnets outside the allow-list. Run periodic automated policy tests: a scripted probe from a contractor VLAN host attempting to reach a sample of internal servers, expecting denies, and from an IoT device to its server, expecting success.
For operations continuity, stage the rollout by floor and by device class. Badge readers are safety-critical: verify that access-control events still register within the expected latency before expanding. HVAC controllers often use proprietary protocols and broadcast discovery; if they rely on broadcast, ACLs may break discovery, so test in a pilot.
Finally, document the intended flows in a matrix and keep it in the change-management system. When a new IoT device class arrives, the matrix is updated and the ACLs changed through the same process.