Store Segmentation Cutover Kills the POS Estate
NorthLine Retail operates 42 stores. Each store has one Layer 2 access switch, a branch router that performs inter-VLAN routing and carries the WAN uplink, POS terminals, a store controller, and staff Wi-Fi handhelds. Terminals obtain addresses from the controller by DHCP and locate it through a Layer 2 broadcast discovery protocol; the controller then proxies card authorizations to HQ. A consultant proposes moving all POS terminals into VLAN 900, with an inbound ACL on the VLAN 900 interface permitting only DHCP replies to the terminals and traffic to the HQ payment gateway, and denying everything else, in order to shrink PCI scope. The controller stays in VLAN 1 because vendor re-certification to move it takes nine months. In the three-store pilot, every terminal stopped transacting within one hour of cutover, while store staff continued to browse the internet normally from their handhelds.
1. The pilot lost all terminals within an hour. Identify the specific failure points in the proposed design and state which element of the design has to change.
Read the worked answer
The design fails at Layer 2, and the failure is over-determined - two separate dependencies break.
- Addressing. Terminals in VLAN 900 broadcast DHCPDISCOVER. Broadcasts do not cross a router, and the controller acting as DHCP server sits in VLAN 1. No DHCP relay (
ip helper-addresson the VLAN 900 interface) is in the design, so terminals never obtain a lease. That alone explains a total outage inside the first lease renewal window. - Discovery. Even with a relay, the vendor protocol locates the controller using Layer 2 broadcast. A relay forwards DHCP only; it does not forward discovery frames. And the ACL as written permits only DHCP replies and payment-gateway traffic, so a unicast discovery frame to VLAN 1 would be dropped anyway.
The ACL is also applied to traffic entering VLAN 900 from the terminals, which is precisely where the DHCPDISCOVER originates - the consultant wrote a filter that blocks the very bootstrap traffic the terminals need. The handhelds kept working because they were never moved and never depended on the controller.
The element that must change is the L2 boundary: terminals and controller must share a broadcast domain, or the vendor must provide a unicast discovery option. The consultant used segmentation to solve a scope problem that is really an L3/L4 policy problem.
2. The vendor offers to configure static IP addresses and a hard-coded controller address on every terminal as a workaround. Evaluate whether this restores service and whether it delivers the stated PCI goal.
Read the worked answer
It restores service only partially, and it does not deliver the goal.
Service: static addressing removes the DHCP dependency, and a hard-coded controller address removes the broadcast discovery dependency - but only if the vendor's client genuinely supports a unicast controller address. That must be confirmed in writing, because 'static IP' and 'static controller' are different features and vendors conflate them. The ACL still bites: with terminals in VLAN 900 and the controller in VLAN 1, terminal-to-controller traffic now crosses the router as unicast. The ACL permits only DHCP replies and the HQ gateway, so the traffic is denied. The rule set must be widened to permit terminal-to-controller on the specific ports, which reopens exactly the path segmentation was meant to close. Operations: 42 stores times an unknown terminal count become manually addressed. There is no central inventory, no protection against duplicate addresses, and re-imaging a terminal becomes a site visit. That cost recurs every refresh cycle. Scope: PCI scope does not shrink. The controller remains in VLAN 1 alongside staff handhelds and the branch router, so the cardholder data environment still includes a shared segment. Static addressing changes nothing about what is in scope.
A workaround that costs more, fails the ACL, and delivers no scope reduction should be rejected in favour of redesigning the segmentation.
3. Propose a segmentation design that shrinks PCI scope given the nine-month constraint on moving the controller. Give three concrete controls and say what each one buys you.
Read the worked answer
Accept the constraint: the controller is the anchor of the cardholder data environment for the next nine months, so it defines the boundary rather than the terminals.
Design: create VLAN 900 as the CDE and place both the controller and the terminals in it, moving the terminals and the controller together is impossible for the controller, so instead move the handhelds and everything else out. If the controller cannot move at all, then the smallest defensible CDE is the existing VLAN 1 minus everything that is not the controller - which means moving handhelds and any other endpoints off VLAN 1. The realistic compromise is: VLAN 900 = terminals and controller cannot be co-located, so keep terminals adjacent to the controller at L2 (same VLAN 1, dedicated access ports) and enforce the boundary at L3/L4 rather than pretend a VLAN split exists.
Controls:
- Egress ACL on the router's VLAN 1 interface permitting the controller only to the HQ payment gateway on the required ports, and terminals only to the controller. Deny all internet egress from those ports. This is the control that actually shrinks scope, because it limits where card data can flow.
- Switch-port hardening: dedicated access ports for terminals and controller, port security limiting MAC counts, DHCP snooping and dynamic ARP inspection on VLAN 1, and disabling unused ports. This prevents a rogue device from joining the CDE segment and impersonating the controller.
- 802.1X or MAC authentication bypass on the terminal ports, with the handheld SSID mapped to a separate VLAN and client isolation. This makes the staff Wi-Fi definitively outside the CDE and auditable.
Add NetFlow from the branch router to the SIEM with an alert on any CDE host talking to anything other than the gateway - the compensating control for the missing L2 split.