Sixty Flat Networks and One Curious Contractor
FreshMart operates 60 small grocery stores. Each store runs a flat /24 network: six point-of-sale terminals, four back-office PCs, eight IP cameras with factory-default credentials, and guest Wi-Fi - all on the same Layer 2 segment with no ACLs. Last month a contractor joined the guest Wi-Fi, ran a port scan out of curiosity, and reached the web management interface of a POS terminal. Nothing was exploited, but the store manager has now opened a ticket saying the firewall 'blocks the new inventory app' and wants all outbound traffic permitted. The stores have managed switches but no budget for new hardware this year, and no store can close for maintenance.
1. Design a segmentation plan that works with the existing hardware, requires no store downtime, and protects the POS terminals. State what you would do first and what you would defer.
Read the worked answer
Constraint check first: the switches are managed, so VLANs on existing gear are viable. No new hardware means no new firewalls at the edge - inter-VLAN policy has to live on the existing Layer 3 device.
Target zones:
| Zone | VLAN | Allowed to reach |
|---|---|---|
| POS terminals | 10 | Payment processor endpoints only |
| Back office | 20 | Internet, printer, limited POS reporting port |
| Cameras / NVR | 30 | NVR only; no route to POS or internet |
| Guest Wi-Fi | 40 | Internet only |
Sequencing (this is the judgement call):
- Guest isolation first. It is the demonstrated attack path from last month, it is one ACL, and it breaks nothing operational. Guest to internet only, deny to RFC1918.
- Cameras second. Default credentials plus no patch path make them a permanent liability. Change credentials, move them off the POS segment, deny camera-to-POS in both directions. The NVR keeps working.
- POS zone third, in overnight windows per store, with a rollback plan and a payment test transaction before sign-off.
- Defer: NAC and 802.1X port authentication - those do need hardware and process work.
Blast-radius note: one store at a time, never a fleet-wide change, and confirm the POS can still authorize a card before you leave.
2. Diagnose the contractor incident. Which control failed, and does the incident change your priority order?
Read the worked answer
What failed:
- No enforcement point between zones. A flat Layer 2 segment means every device is one broadcast domain away from every other device; port scanning is not an exploit, it is just asking politely.
- Guest Wi-Fi was bridged into the corporate segment rather than terminated outside it.
- POS management interfaces were reachable from untrusted networks - the management plane should never be exposed to guest traffic.
- No detection. A scan of the POS segment produced no alert, and only surfaced because the contractor mentioned it.
Does it change priorities? It confirms them. The ordering was already guest-isolation-first on the grounds of cost and zero operational risk; a real, demonstrated path from guest network to a payment device moves it from 'should' to 'this week.'
What it should not do: trigger a rushed, fleet-wide re-architecture announced as an emergency. The right response to a near-miss is a fast, narrow fix plus a scheduled plan for the rest - not a panic that breaks 60 stores' payment processing in one night. Document the incident as the business justification for the remaining phases.
3. How do you handle the store manager's request to allow all outbound traffic so the inventory app works?
Read the worked answer
Treat it as a legitimate request with an unclear specification. The manager is not asking for 'any outbound' - she is asking for the inventory app to work. Start there.
Process:
- Get the specifics: application name, vendor, destination hostnames or IPs, ports, protocol, and whether it uses a fixed cloud endpoint or a CDN range.
- Test, don't guess. Reproduce the failure from a back-office PC and capture what is actually being blocked.
- Write the narrowest rule that works: source = back-office VLAN only (never guest, never POS), destination = the documented endpoints, port = the one required, protocol specified.
- Make it temporary and logged. Set an expiry (30–90 days), enable logging, and review whether it is still needed.
- Document and reply in business terms: 'the app now works; here is what we opened and when we will review it.'
Why not grant the blanket rule: 'allow any outbound' converts every compromised PC into an unrestricted exfiltration channel and destroys the value of the segmentation work. If the vendor genuinely cannot document endpoints, that is a vendor-management problem, not a firewall problem - escalate it rather than absorbing it into the rule base.