Post-Acquisition Segmentation Before a PCI Assessment
Ridgeway Retail Group (3,100 employees, 420 stores) acquired Lumen Logistics, a 700-employee freight company. The combined environment has a flat 10.10.0.0/16 at Lumen, 14 sites, one data center, and a PCI cardholder data environment at Ridgeway. Lumen's network includes 38 servers (12 Windows Server 2008 R2), 140 handheld scanners, and conveyor controllers that cannot be patched during 24/7 peak season. A recent internal scan found that a domain controller at Lumen is reachable from the guest Wi-Fi, and SMB traffic crosses between the corporate LAN and the conveyor VLAN. Ridgeway's PCI assessment is in six months. The board approved $500,000 and nine months for segmentation; the network team proposes a three-year microsegmentation rollout. The CISO must decide what to do in the first 90 days and what target architecture to commit to.
1. Prioritize the first 90 days. Which controls would you deploy immediately, and which segmentation work can wait? Justify by risk and PCI scope.
Read the worked answer
First 90 days: treat the guest-Wi-Fi-to-domain-controller path as an emergency. Put a deny rule between guest and all internal zones, restrict domain controller access to the management VLAN and jump hosts, and block SMB between corporate and conveyor VLAN except approved flows. Isolate the 12 Windows 2008 R2 servers behind a firewall with allowlists rather than leaving them flat; they are unsupported and should be migrated, but isolation is the compensating control. Put conveyor controllers on their own OT VLAN with no internet and no corporate SMB.
These actions reduce immediate lateral movement and shrink PCI scope. Full microsegmentation of 420 stores can wait because it is broad and slow; the CDE and Lumen data center cannot. The six-month PCI deadline drives sequencing: scope reduction first, then segmentation validation, then store refresh. Document any OT exception because patching is impossible during peak.
2. Evaluate the proposed three-year microsegmentation rollout against the six-month PCI deadline. What architecture and sequencing would you recommend, and how would you validate it?
Read the worked answer
Reject a three-year rollout as the only plan. Use a hybrid: quick zoning and ACLs now, then host-based microsegmentation in the CDE and Lumen data center, then stores. Define zones: CDE, corporate, guest, OT, management, and third-party VPN. Default-deny between zones, allow only required ports, and force vendor access through a jump host with MFA and session recording.
Validate with flow logs, rule-hit reviews, a PCI segmentation penetration test before the assessment, and re-test after changes. Because PCI segmentation must be proven, not just designed, build evidence: diagrams, firewall rule exports, test results, and change tickets. For OT, use industrial firewall rules and one-way data flows where possible. Budget the $500,000 toward the CDE and data center first; do not spread it thinly across all stores.
3. What would you do about the 12 Windows Server 2008 R2 systems, and how would you govern the residual risk?
Read the worked answer
Assume they are exploitable and cannot be made compliant by patching. Immediate: network isolation, no internet, restricted admin, EDR if supported, application allowlisting, and enhanced logging. Then inventory owners and dependencies, set a migration deadline, and report an exception with residual risk to the risk committee. If a server supports conveyor operations that cannot stop, use a maintenance window during a planned outage and test rollback.
Do not grant a permanent exception; require monthly review and a funded migration plan. If PCI data touches them, they must be out of scope or isolated with documented compensating controls accepted by the QSA. The judgement is to buy time with isolation while funding removal, not to treat an unsupported OS as acceptable because the line cannot stop.