One Flat Network and a Vendor Who Wants RDP
A 340-employee freight-forwarding company runs everything on a single flat /16: corporate laptops, warehouse Wi-Fi serving 180 handheld barcode scanners, the WMS application and database servers, and the domain controllers. A penetration test last quarter found SMB signing disabled, LLMNR enabled, and 14-year-old switches with no VLAN support at the two smaller depots. The WMS vendor has asked for inbound RDP from the internet to a support server so its engineers can troubleshoot, arguing that a VPN is too slow to schedule. The security budget covers one firewall pair with IPS, two managed switches for the main site, and a PAM appliance; there is no money for new depot switches this year. The IT manager wants to deal with the vendor RDP request first because it is the thing most likely to get them breached, while the infrastructure lead wants VLANs first because segmentation is the foundation.
1. The IT manager wants the vendor RDP request handled first, the infrastructure lead wants segmentation. Which comes first, and why?
Read the worked answer
Neither argument is wrong, but they are different kinds of risk. Internet-reachable RDP is a path from any attacker on the planet to a server inside the network; segmentation limits what happens after a host is already compromised. Initial access outranks lateral movement in urgency, and the fix costs nothing - it is a decision, not a project.
Sequence:
- Withdraw inbound 3389 today. Offer the vendor VPN with MFA and brokered RDP through the PAM appliance or a DMZ jump host, with source-IP restriction, session recording and an approved change window. This can be built on the existing firewall pair without waiting for switches.
- Take the free wins that undercut lateral movement while segmentation is being planned: enable SMB signing, disable LLMNR and NBT-NS by GPO, deploy LAPS, split tiered admin accounts.
- Then segment, because segmentation done hastily on a flat network causes outages and gets rolled back by the business.
Frame it for the IT manager as policy first, engineering second: the vendor does not get to choose the transport.
2. Design the first three segments given one firewall pair and two switches, and state what the rules between them should look like.
Read the worked answer
Design from data flows, not from the org chart. A realistic first cut with that hardware:
- Edge/DMZ: the vendor jump host and anything accepting inbound sessions. Rules: internet to DMZ only on the brokered port; DMZ to internal only to the one server it supports, on that service port; no general DMZ-to-LAN access.
- Server segment: WMS application and database, with the database reachable only from the app tier on its port. Domain controllers on their own segment, with client traffic limited to Kerberos, LDAP, DNS and time.
- User segment: workstations, default deny between users - no workstation-to-workstation SMB - and outbound via a proxy.
- Scanner/warehouse Wi-Fi: permit only the WMS endpoint on the specific port; no internet, no SMB.
Every rule set ends in default deny with logging. One rule people forget: management access to the firewall and switches comes from a dedicated admin segment, with MFA, never from the user VLAN. Rules should be written to survive the next application, so name them by flow and document the owner.
3. The two depots cannot be segmented with their current switches. What compensating approach do you take there, and what do you record?
Read the worked answer
Do not pretend the depots are segmented. Treat them as untrusted enclaves:
- Boundary router or small firewall at each site, default deny inbound, permitting only the specific depot-to-WMS flows.
- Managed host firewalls so workstation-to-workstation traffic is blocked even inside the flat LAN - this recovers much of the lateral-movement benefit without new switches.
- Separate SSID for scanners, mapped to a dedicated VLAN on the managed equipment upstream, with 802.1X or MAC port security where supported.
- Assume compromise: EDR on depot endpoints, central log shipping, no Domain Admin credentials cached at those sites, and local admin passwords managed by LAPS.
Record it properly: the pen-test finding as evidence, the compensating controls as implemented-and-tested, the residual risk rating, a named owner and an expiry date tied to next year's switch replacement. A visible, dated gap is an accepted risk. A silent one is the thing an auditor will find and an attacker will use.