The finding that mattered in last year's assessment was not a vulnerability. The tester plugged a laptop into a socket in a meeting room, obtained an address, and from there opened a management port on the server that runs our payments processing. Nothing was exploited. Nothing needed to be. The point was that the path existed.
We were not unaware of segmentation. We had virtual networks, we had a firewall between the offices and the data centre, and we had a diagram showing the two as separate zones. What the diagram did not show was a rule permitting the whole internal address range through that firewall, added in 2019 during a migration, with a comment saying it was temporary and the name of somebody who left in 2021. Underneath it were four hundred other rules, roughly a third of which nobody could explain and none of which anybody was willing to remove.
That last part is the real subject. Segmentation is not technically difficult. It is difficult because the work is entirely downside. Nobody notices the attack that becomes harder, everybody notices the reporting tool that stops working on a Tuesday afternoon, and the engineer who removes a rule owns whatever breaks for a fortnight afterwards. So rules accumulate in one direction, and a network becomes flat by patience rather than by decision.
What made progress possible was giving up on segmenting everything. We picked the payments estate and the finance systems, logged every flow reaching them for six weeks before changing a single rule, and turned that log into a documented list of what is supposed to talk to them. Anything not on the list was denied, with the exceptions named, owned and dated. The camera system, the door controllers and the printers went onto their own segment, because none of them should ever have been able to reach a server and all of them run software their vendors last updated years ago.
We measure it with one number now: how many hosts on our network can open a connection to the payment systems. It was somewhere above four thousand. It is thirty-eight.
Flat networks are not built. They are inherited, one reasonable exception at a time.
– Serguey Shinder
Top comments (0)