Holiday Containment in a Flat Retail Network
A retail chain operates 220 stores and 1,900 point-of-sale terminals on a flat MPLS network. PCI scope includes every store because POS traffic shares the same VLAN as back-office PCs and guest Wi-Fi. A new SD-WAN pilot covers 12 stores. The MSSP reports SMB scanning from three store back-office PCs toward POS subnets; EDR shows the same unsigned binary on all three. Store operations has a 24-hour holiday change freeze starting in 36 hours; the CEO wants no store downtime. The network team proposes urgent ACLs at the MPLS provider, but the provider needs 72 hours. The security team can remotely isolate the three PCs, which would take those stores offline for POS because the POS controller runs on the same PC. A vendor uses shared TeamViewer credentials for support across all stores. The CISO must decide containment versus holiday availability.
1. What immediate containment actions would you take in the next 36 hours, and what is the acceptable business trade-off?
Read the worked answer
Isolate the three back-office PCs from POS subnets while trying to preserve the POS controller function. Apply host firewall rules blocking SMB ports 139 and 445 except to the POS controller, quarantine the unsigned binary through EDR, reset the shared TeamViewer credentials, restrict vendor access to named technicians with MFA, and block SMB at the store edge where the SD-WAN pilot allows it. The acceptable trade-off is temporary offline or manual card processing at three stores, not risking all 220. The holiday freeze should not block emergency security changes; obtain written CIO and COO approval for a narrow change window and communicate it to store operations. Do not wait 72 hours for the provider. Do not dismiss the scanning because it might be benign; an unsigned binary plus SMB scanning to POS is enough to act. Decide by risk: three stores degraded is smaller than a chain-wide payment compromise during peak season.
2. How would you sequence segmentation across 220 stores after the holiday, given PCI scope and the SD-WAN pilot?
Read the worked answer
Do not boil the ocean. Define zones first: POS, back-office, guest, management, and vendor. Use the 12-store SD-WAN pilot to validate the design, measuring POS performance and support tickets before scaling. Enforce PCI scope reduction by isolating the POS VLAN and restricting it to the payment processor and POS management, and remove guest Wi-Fi from the POS path. Standardize a store template through SD-WAN policy, then roll out in regional waves with a two-week bake period. Retire shared vendor access in favor of a jump host with MFA and session recording. Prioritize stores with scanning indicators, then highest transaction volume. Validate with vulnerability scans and penetration tests, and do not claim PCI scope reduction until segmentation is tested. Budget for legacy devices that cannot tag VLANs, because they will otherwise become the exception that defeats the design.
3. The MSSP says the scanning could be an authorized vulnerability scanner. What evidence would change your response?
Read the worked answer
Validate, but do not dismiss. Evidence that lowers severity includes a known scanner process hash and parent process, an approved scan window, an authorized scanner IP, a change ticket, no credential access, no persistence, and no lateral movement beyond the scan. Evidence that raises severity includes the unsigned binary, SMB connections to POS, failed logons, new service creation, beaconing, the same binary on three stores, and shared vendor credentials. Ask the MSSP for packet captures, process trees, EDR telemetry, and authentication logs. Even if it is an authorized scanner, keep the host SMB blocks until scope and credentials are corrected, because scanning POS from back-office is itself a segmentation failure. If it is not authorized, escalate to incident response. Document the validation decision and who accepted it. The response is not binary: containment can remain in place while evidence is gathered.