Contractor Laptop on the Building-Management VLAN: Policy, Privacy, and Evidence
A contractor from an HVAC vendor plugs a personal Windows 11 laptop into a wall port in a mechanical room to run diagnostic software. The port sits on the building-management VLAN and has no NAC and no 802.1X. Two days later the network team notices the laptop's randomized MAC requesting DHCP and then SMB scanning 10.30.0.0/24 at about 200 packets per second. One host answers, and the laptop authenticates with the local Administrator account that is shared across 40 building controllers. The vendor contract states the vendor must follow the company Acceptable Use Policy, and the AUP permits only company-managed devices on the network. HR wants the laptop imaged; the vendor refuses. Legal asks whether the SOC may keep monitoring the laptop's traffic and whether the employee who escorted the contractor should be interviewed.
1. Which policy and control failures allowed this, and what would prevent recurrence?
Read the worked answer
Three failures. The AUP exists but is unenforced - without NAC or 802.1X on the mechanical-room port, the policy was a document, not a control. The shared local Administrator password across 40 building controllers violates unique-credential-per-device, so one laptop guessing one password reaches 40 systems. And there is no vendor-access procedure: no pre-registration of the contractor device, no device check-in as part of escorted access, and no out-of-band management network for building systems. Preventive fixes: 802.1X with MAC-based profiling on every access port including mechanical spaces, a dedicated vendor VLAN whose firewall rules permit only the controllers' management ports, unique per-device administrator credentials or a privileged access vault, a vendor onboarding checklist requiring company-issued devices or an inspection, alerting on new MAC addresses in building-management subnets, and disabling SMB on controllers that do not need it, plus host firewall rules that forbid east-west SMB.
2. May the company image the laptop, keep monitoring it, and interview the escorting employee?
Read the worked answer
The company almost certainly cannot image the contractor's personal laptop. Device ownership rests with the vendor, and the AUP binds the vendor's conduct; it does not grant the company forensic rights over third-party hardware. Imaging without written consent creates legal exposure and can taint the evidence. What the company can do: request voluntary surrender for imaging in writing, with vendor management and Legal present; if refused, preserve what it owns - DHCP, NAC, firewall, and switch logs, controller authentication logs, and any EDR-visible traffic - and send the vendor a preservation letter. Monitoring: the company may monitor traffic on its own network, but continuous monitoring tied to an identified person raises privacy obligations depending on jurisdiction, so scope it to security-relevant traffic and document the legal basis. Interviewing the escort is an internal HR matter and is fine, but coordinate with HR, keep it fact-finding, and do not turn it into a disciplinary interrogation before facts are established.
3. Walk the response through detection, containment, eradication, recovery, and evidence handling, noting retention risks.
Read the worked answer
Detection and analysis: confirm the SMB scan and the successful authentication, identify which controller was accessed and whether its configuration changed, and establish the entry path - an unmonitored wall port with no NAC. Containment: disable the switch port, block the MAC, segment the 40 controllers from the corporate network, and force a reset of the shared administrator password, which means touching all 40 devices and therefore needs a scheduled maintenance window with the operational risk accepted in writing. Eradication: rebuild any touched controller from a known-good configuration and verify firmware hashes. Recovery: restore building automation, then monitor for recurrence. Post-incident: vendor AUP acknowledgement and a NAC rollout. Evidence handling: retain the switch port configuration, DHCP lease, firewall and authentication logs with hashes and timestamps, record chain of custody for each item, and note who handled what. The two-day detection gap means logs may have rolled, so check retention first and place a hold on any source at risk of ageing out.