PCI Microsegmentation in a Shared Data Center
A payment processor runs 40 PCI-scoped workloads in a shared data center alongside 600 non-PCI workloads. The PCI zone is currently a flat VLAN protected by a pair of perimeter firewalls with 4,000 rules; change volume is 200 requests per month and the average approval takes nine days. An auditor requires cardholder data environment isolation and quarterly evidence of least privilege. The security team proposes host-based microsegmentation, but 12 workloads run unsupported OSes and 15% of traffic is encrypted with no visibility. A recent penetration test found lateral movement from a compromised non-PCI jump host to two PCI workloads over SMB. The CIO wants a 90-day remediation plan that does not break the 7 partner integrations, which use fixed IPs and non-standard ports. The partner integrations are business-critical and cannot be re-IPed during the project.
1. Choose an enforcement approach for the PCI zone, comparing network segmentation, host-based microsegmentation, and a hybrid model.
Read the worked answer
Use a hybrid enforcement model, because no single control covers this estate. Network segmentation is still the right boundary for the PCI zone and the seven partner integrations: put partner ingress on dedicated VRFs or interfaces, allow only fixed IP/port pairs, and keep the 4,000-rule perimeter from being the only control. But the lateral SMB finding is inside the zone, and host-based microsegmentation is the only practical way to get workload-to-workload least privilege at 40 workloads without re-cabling. The 12 unsupported OSes and 15% encrypted traffic are the constraint: host agents may not install or may not see inside TLS, so those workloads need network ACLs and, where possible, a traffic mirror or service mesh. Do not choose host-only; you would lose partner ingress control and encrypted-traffic visibility. Do not choose network-only; you would not stop east-west SMB. Enforce default-deny between tiers, with explicit allow for the partner flows.
2. Lay out a 90-day plan, including how to handle the 4,000 existing firewall rules and the fixed-IP partners.
Read the worked answer
The 90 days should be discovery, then monitor, then enforce, not a firewall rule migration. Days 1–30: collect flow data from the perimeter, host agents where supported, and a SPAN/TAP for the encrypted and unsupported workloads; build an application dependency map for the 40 PCI workloads and the seven partners. Days 31–60: convert the 4,000 rules into intent groups such as partner ingress, PCI tier, management, and backup, and run the new policy in monitor mode. Expect the rule count to fall sharply because most rules are any-any or stale. Days 61–90: enforce in three waves, starting with non-partner east-west SMB, then partner ingress, then the remaining tiers. Keep a documented break-glass path and a rollback. Fixed IP/port partners go into a dedicated ingress segment with a change-controlled allowlist; do not force them into dynamic identity policy. Quarterly evidence comes from policy hit counts, denied-flow logs, and a rule recertification.
3. Address the SMB lateral-movement finding and describe the quarterly evidence you would present to the auditor.
Read the worked answer
The SMB lateral movement is the first thing to close because it is both a real risk and a quick win. Block TCP 445 between the non-PCI jump host segment and the PCI tier at the network and host layers, then verify with a denied-flow log. More broadly, default-deny between PCI and non-PCI, allow only the documented application flows, and require a business owner for each exception. For evidence, produce a quarterly report that shows policy coverage of all 40 workloads, denied flows by source/destination, exceptions with expiry dates, and a sample of partner ingress rules. The 12 unsupported OSes and encrypted traffic should be called out as compensating controls, not hidden. If the auditor asks for least privilege, the answer is the allowlist plus the change history, not the 4,000-rule firewall.