Segmentation Decision for a Legacy Payments-Capable ERP
Northline Retail runs a 14-year-old on-premise ERP that processes card data for 212 stores. The ERP sits on the same flat VLAN as point-of-sale controllers, back-office file shares and a Windows Server 2008 print server. The vendor states it will not support TLS 1.2 or tokenized card data before the planned SaaS migration completes in 18 months, and the support contract lapses in 9 months. The CISO has 200,000 USD of capital budget this year. A reseller proposes an inline next-generation firewall between the ERP and the POS VLAN with application-aware rules, priced at 165,000 USD including three years of support, plus a 30,000 USD managed SOC rule-tuning engagement. The infrastructure team instead wants the ERP moved to a dedicated VLAN with host-based firewalls and access restricted to a jump host, costing about 40,000 USD in overtime and change windows. The PCI assessor has asked for a documented network boundary before the next assessment in five months.
1. Recommend an architecture direction and justify it in terms of scope reduction, residual risk and the five-month assessor deadline.
Read the worked answer
Recommendation: fund the dedicated-VLAN and jump-host design now, and treat the inline firewall as a later, optional enforcement layer rather than the primary control.
Reasoning chain:
Does the proposal reduce PCI scope? Only if cardholder data no longer flows to, or is stored by, the ERP. The ERP still authorizes and stores card data, so it remains in the CDE either way. An inline firewall changes the traffic path, not the scope. Scope reduction requires isolation of the CDE plus, eventually, tokenization or P2PE so the ERP never holds a PAN.
Which option is achievable in five months? A procurement of 165,000 USD of hardware, plus rule design, baselining and SOC tuning, realistically consumes 90-120 days before any tuning is credible. The VLAN rebuild uses existing switching, is reversible, and is a prerequisite for whichever option is finally chosen.
Residual risk comparison. The flat VLAN exposes the ERP to lateral movement from any compromised store PC - the dominant retail attack path. The VLAN plus jump host removes that path and gives the assessor a defensible boundary diagram. The firewall without segmentation leaves the same east-west exposure on the protected side.
Budget use. Roughly 40,000 USD for the rebuild, with the balance funding EDR on the ERP hosts, log onboarding and migration acceleration - the only measure that retires the unsupported software.
State the accepted residual risk explicitly: the ERP remains in scope and unpatched, mitigated by isolation, restricted administrative access, and enhanced monitoring until decommissioning.
2. What must be true for a compensating control to be creditable to the assessor, and what evidence would you assemble?
Read the worked answer
A compensating control is not a promise; it is a documented, tested, maintained control that meets the intent of the original requirement and addresses the risk the requirement was designed to reduce. Credibility rests on six properties: it exists, it is documented, it is enforced technically where possible, it is monitored, it is owned, and its failure mode is known.
Evidence pack:
- Design document naming the specific requirement not met, the risk it protects against, and how the alternative control mitigates that risk (not merely a different control).
- Enforcement proof: switch and firewall configurations, ACLs, jump-host hardening baseline, and a rule-set review signed by the network owner.
- Boundary diagram and data-flow diagram showing every path into and out of the ERP, validated against live traffic rather than intent.
- Test results: attempted connections from a store representative host and from a general corporate host, showing denial; fail-closed behaviour under link and power failure; jump-host session recording.
- Monitoring: log sources feeding the SIEM, alert rules for jump-host anomalies, and a review cadence with named reviewers.
- Change control and drift detection: configuration baselines compared at least monthly, with exceptions ticketed.
- Ownership and review date, plus a termination condition tied to the migration date.
Bring the assessor in early, before the assessment window, so the control narrative and evidence are agreed rather than argued on the last day.
3. Vendor support lapses in nine months regardless. How does that change the plan, and what decision gates would you set?
Read the worked answer
The support lapse is the dominant risk, not the firewall question. Once the vendor stops issuing patches, the ERP becomes a permanently exploitable asset; every other control is a delaying tactic. The architecture should therefore be designed around the assumption that the ERP is unsupported from month nine.
Plan changes:
- Isolation hardens: from month nine, no direct internet access, no vendor remote access without a supervised, recorded session, and egress restricted to the payment processor endpoint only.
- Extended support evaluation: price third-party extended support or an escrow-backed maintenance agreement; compare it against the cost of accelerating migration. A 200,000 USD capital budget can plausibly buy either, not both.
- Migration acceleration: renegotiate the SaaS timeline; 18 months is a business estimate, not a physical constraint. Ask for a phased cutover of the highest-risk stores first.
Decision gates:
- Month 4: segmentation complete and independently tested; assessor pre-briefed.
- Month 6: go/no-go on extended support purchase, based on migration progress evidence, not optimism.
- Month 8: if migration has not reached 50% of stores, invoke the fallback - contract extended support and freeze scope expansion on the legacy ERP.
- Month 9: executive-signed risk acceptance covering the residual exposure, with a named owner and a stated review date.
Each gate has an owner and a written criterion so the decision is made on evidence rather than at the point of crisis.