Microsegmentation on a Flat Plant Network
You are the security architect for a manufacturer with two data centers and 1,100 workloads running on a flat Layer 2 network with 42 VLANs. A recent intrusion began on a phished laptop and reached a database server in another VLAN within nine minutes, so the board has mandated microsegmentation. You have an agent-based microsegmentation product, but 180 workloads run unsupported operating systems that cannot take the agent, including the manufacturing execution system (MES) that controls production. The MES vendor uses a protocol with dynamic RPC ports between its application and database tiers. A change freeze starts in six weeks for fiscal quarter close and lasts five weeks. A pilot in the test environment produced 340 policy violations in the first week, mostly from backup and monitoring traffic that nobody had documented. The project sponsor wants default-deny enforcement in all production segments in eight weeks.
1. The sponsor wants default-deny in all production segments in eight weeks. How would you sequence the work, and what would you tell the sponsor is not achievable?
Read the worked answer
Eight weeks to default-deny everywhere is not achievable without unacceptable outage risk. Propose enforcement rings and a revised commitment. Weeks 1-2: complete flow discovery, application dependency mapping, and owner attestation; the 340 pilot violations show the inventory is incomplete. Weeks 3-4: run agents and network telemetry in monitor mode in production, build allow-lists, and close documentation gaps with backup and monitoring teams. Weeks 5-6: enforce in ring 1 - non-production and low-criticality segments - with rollback tested. Weeks 7-8: enforce ring 2, business-critical but well-understood; keep tier-1 (MES and its dependencies) in monitor mode through the change freeze. During the freeze, no new enforcement except emergency changes with CAB approval. Give the sponsor a dated ring schedule and a metric: percentage of flows labeled and owner-approved before enforcement. The commitment is 'default-deny in ring 1 and ring 2 by week eight; tier-1 after freeze,' not everything.
2. How should the 180 unagentable workloads and the MES dynamic RPC protocol be handled?
Read the worked answer
Unagentable workloads still get segmented; the enforcement point moves from the host agent to the network. Put them in a dedicated legacy zone with deny-by-default ACLs at the perimeter, a firewall or security group between them and other tiers, and a monitored choke point for administrative access. Do not exempt them from segmentation just because the agent cannot be installed. For MES dynamic RPC, first ask the vendor for supported static port ranges or a broker; if unavailable, use a protocol-aware firewall that understands the RPC endpoint mapper, or allow traffic only between named MES hosts and service accounts within the MES zone. Document the exception, monitor it, and set a review date. Add compensating controls: application allow-listing where possible, restricted admin paths, and logging of all flows out of the zone. The goal is to shrink the blast radius, not to achieve agent coverage as an end in itself.
3. What governance and rollback conditions would you require before enforcing default deny in a production ring?
Read the worked answer
Before any ring is enforced: application owner sign-off on the policy, a tested rollback that can restore the previous rule set within 15 minutes, a maintenance window and on-call bridge, and an exception process that can be executed in minutes. Require a pre-enforcement report showing all flows and their owners; any unlabeled flow blocks enforcement of that segment. Change advisory board approval, a communications plan for the affected business unit, and success criteria: no increase in Sev-1 incidents, no unplanned downtime, and a documented count of denied business flows. After enforcement, monitor for 72 hours and review denied traffic daily. If a rollback occurs, do not re-enforce until root cause is fixed. Also agree with the sponsor that the freeze period is change-limited; emergency enforcement requires CISO and CAB approval. These conditions protect the sponsor's own production targets.