Split Tunneling and Push Fatigue at Vantage Retail
Vantage Retail operates 64 stores, a 900-person workforce, and a FortiGate VPN concentrator with split tunneling enabled to keep 40 Mbps MPLS links from saturating. Store managers authenticate with password plus push MFA. On a Friday night, a manager approved seven push prompts in a row and later reported the phone kept buzzing. VPN logs show a login at 02:14 from a Netherlands IP, followed by SMB connections to 31 internal hosts in 12 minutes, including the POS management server. The firewall has 1,200 rules, 43 of them any-any, and the store and corporate networks share one flat VLAN. The help desk resets MFA by verifying caller ID and employee number. Store operations says disabling split tunneling will break nightly inventory sync at 20 low-bandwidth sites. The PCI assessment is in eight weeks.
1. Assess the risk from split tunneling and push-based MFA in this environment, and recommend the changes that reduce risk fastest without breaking store operations.
Read the worked answer
Split tunneling is not what allowed the SMB scan; traffic to internal hosts still traverses the tunnel, which is why 31 hosts were reachable. Its real cost is loss of egress visibility and inspection, because store devices can reach the internet directly, and the flat VLAN turned one VPN account into a path to the POS management server. Push MFA is the more immediate failure: repeated prompts train users to approve, and seven approvals in one night is textbook MFA fatigue. Fastest risk reduction, in order: enable number matching and additional context in the MFA prompt (or move VPN to FIDO2 for managers), rate-limit and lock after repeated denials, and disable push as a standalone factor for VPN. In parallel, restrict the VPN pool with a firewall policy that permits only the hosts each store role needs, and remove the any-any rules that expose the POS management server. These changes are configuration-only and do not depend on link upgrades. Keep split tunneling for now, but route store internet through a cloud proxy or DNS filtering so egress is visible. The residual risk is that a compromised store device can still reach permitted internal hosts, which is why segmentation must follow.
2. You can only complete one segmentation project before the PCI assessment. Which segment do you build first, and why?
Read the worked answer
Build the POS segment first. The evidence puts the POS management server inside the attacker's 12-minute SMB sweep, and PCI scope and penalties attach to cardholder data environment exposure. A POS segment gives the largest reduction in assessed scope and in real blast radius at the same time. Concretely: move POS terminals and the management server to a dedicated VLAN behind a firewall with default deny, allow only the payment processor endpoints and a management jump host, and log all denied traffic. Do not rely on the existing VLAN separation, because the current design is flat. Second priority is the VPN pool, so remote sessions land in a quarantine segment with jump-host access only. Corporate user VLANs can wait. The trade-off is operational: store provisioning and patch distribution must be reworked, and the jump host becomes a high-value target that needs MFA, patching, and session logging. That is preferable to leaving the POS server reachable from every VPN session during the assessment.
3. Store operations objects to turning off split tunneling. Give a recommendation that addresses their constraint and its residual risk.
Read the worked answer
Do not fight the constraint head-on. The 40 Mbps links cannot carry all store traffic, and forcing it would cause inventory sync failures that push staff to work around controls. Recommend a split-tunnel policy that keeps business-critical SaaS and update traffic local but forces all other internet access through a cloud secure web gateway via a proxy PAC or DNS policy, with direct outbound blocked at the store firewall. That preserves bandwidth while restoring egress logging, malware blocking, and the ability to detect command-and-control. Pair it with per-store firewall rules that deny store-to-store and store-to-server traffic except approved flows. Residual risk: traffic to approved SaaS still bypasses the corporate inspection stack, so a compromised device can exfiltrate through those destinations; mitigate with CASB or API-level monitoring and conditional access on the SaaS tenants. Document the exception with the CISO, a review date, and a funded plan to upgrade the 20 low-bandwidth links. The recommendation is defensible because it reduces the dominant risk, which is uninspected egress and lateral reach, without breaking nightly sync.