Funding the First Control in a Flat Logistics Network
You are the security lead for a 400-employee third-party logistics company that has never had a dedicated security team. The network is a flat /16: 180 servers, 1,100 endpoints, and three domain controllers share one VLAN with user laptops. The internet edge firewall permits any outbound TCP 80/443. EDR is deployed on 760 of 1,100 endpoints because 340 warehouse scanners run Windows CE and cannot run an agent. VPN access for 240 remote users is password-only. Last quarter's phishing simulation had an 18% click rate and two users entered credentials. The board approved $120,000 one-time plus $8,000/month and asked for a zero trust program after reading about a peer company's ransomware loss. The CIO wants 802.1X network access control first; the operations director wants full EDR coverage; the CFO wants MFA on VPN before the next quarter close. Nothing has been purchased yet.
1. Using attack-path reasoning, rank the three proposed investments and state what you would fund first. Identify the assumptions you are making and the evidence you would pull to confirm them.
Read the worked answer
Ranking: 1) MFA on VPN, 2) segmentation and egress control funded from the 802.1X budget, 3) EDR expansion, 4) 802.1X last.
Reasoning: The observed precursor is credential phishing (18% click rate, two credential entries), and the only remote entry point is password-only VPN for 240 users. An attacker with valid credentials bypasses 802.1X entirely: 802.1X authenticates a device or switch port, not the human, and stolen VPN credentials arrive over the internet rather than a wired port. MFA directly breaks that path. Next, the flat /16 means one compromised laptop can reach domain controllers and the file servers. Host firewalls and VLAN ACLs between user, server, and scanner segments are cheaper than 802.1X and reduce blast radius. The EDR gap matters, but 340 Windows CE scanners cannot run an agent; compensating controls are segmentation and restrictive server-side allowlists. 802.1X is useful against rogue wired devices but addresses a lower-probability path here.
Assumptions to test: VPN logs show password-only authentication and no device posture; there is no alternate remote access such as an RDP gateway or Citrix; scanners do not store regulated data. Pull 90 days of VPN logs for successful authentications from new ASNs and impossible travel, and confirm whether any phishing-entered credentials were reused.
2. Design a 30-day validation plan for the control you funded first. What metrics would prove it is working, and what would make you escalate?
Read the worked answer
30-day plan: Week 1: enroll 240 VPN users in MFA, starting with finance and IT; publish a break-glass procedure with two hardware tokens held by the CIO and the security lead. Week 2: run a controlled phishing simulation that clones the VPN login page and measure credential submission; treat any submission as a training event, not discipline. Week 3: query VPN logs for authentication method and confirm zero password-only successes; review helpdesk tickets for lockouts and MFA fatigue. Week 4: tabletop a stolen-password scenario with the SOC and verify the alert fires.
Metrics that prove the control works: percentage of VPN authentications using MFA (target 100%), number of successful authentications from previously unseen ASNs, MFA denial rate, helpdesk tickets per 100 users, and time-to-enroll. A phishing simulation click rate alone is a weak metric; the meaningful one is credential submission followed by a blocked MFA prompt.
Decision gate: If enrollment is below 95% by day 21, escalate to the CIO because the residual password-only path remains. Do not declare success from enrollment numbers alone; verify in logs that password-only authentication is actually rejected.
3. The board asks, 'Are we safe now?' Write the substance of your answer, including residual risk you are accepting and what you would not claim.
Read the worked answer
Residual risk to state plainly: The network remains flat. A single credential compromise can still reach servers, and EDR cannot block on 340 scanners. Egress is unrestricted, so data can leave over 443. Detection coverage is thin outside the 760 agented endpoints.
Board message: We are buying time and reducing the most likely path, not eliminating ransomware risk. MFA removes the cheapest way in, a stolen password. Segmentation limits how far an intruder walks once inside. The remaining exposure is a compromised server or scanner that we cannot see or block automatically.
What I would not claim: that 802.1X or full EDR would have prevented the peer company's loss; neither addresses stolen credentials or a flat internal network by itself. Track a risk register entry with an owner and review date, and set a 90-day milestone for server-to-server segmentation. Ask the board to approve a documented exception for the Windows CE scanners rather than pretending they are covered.