◇ OpenCyber Academy
Engineering · Chapter 28 · English

Chapter 28 — Network and communications security: implementation I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 28 — Network and communications security: implementation I

Lesson map

Lesson 28 published. Map, example, EX082.

flowchart TD
  N0["Learning outcomes"]
  N1["28.1 Phasing"]
  N2["28.2 Pilot office"]
  N3["28.3 Monitor mode findings"]
  N4["28.4 Enforcement"]
  N5["Readdressing devices"]
  N6["Rollback plan"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX082"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["28.1 Phasing"]
  N2["28.2 Pilot office"]
  N3["28.3 Monitor mode findings"]
  N4["28.4 Enforcement"]
  N5["Readdressing devices"]
  N6["Rollback plan"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX082"]

[Learning outcomes]
    |
    v
[28.1 Phasing]
    |
    v
[28.2 Pilot office]
    |
    v
[28.3 Monitor mode findings]
    |
    v
[28.4 Enforcement]
    |
    v
[Readdressing devices]
    |
    v
[Rollback plan]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX082]

Learning outcomes

You will (1) plan phased implementation; (2) migrate a pilot office; (3) verify behaviour.

28.1 Phasing

Implementation proceeds office by office, starting with a small branch. Each phase: prepare configuration, test in lab, migrate during an agreed window, verify and observe for two weeks.

Rolling out segmentation in phases limits risk. Each phase covers a defined set of offices or zones, with entry criteria, such as tests passed, and exit criteria, such as no unresolved service problems. Lessons from one phase change the plan for the next.

A clear phase plan also helps staff know when their office will change.

28.2 Pilot office

The pilot branch has forty devices. Kofi and the council engineers create VLANs, readdress devices and enable the new firewall in monitor mode first, logging what would be denied without blocking.

The pilot uses one small office whose staff agree to report problems. It tests the design under real conditions while limiting the impact of mistakes, and provides evidence for the wider rollout.

Before the pilot, Kofi confirms the office's flows with local staff, prepares the rules in monitor mode, and agrees a short daily check-in. Success criteria are set in advance, so the decision to proceed is based on evidence rather than impressions.

28.3 Monitor mode findings

Monitor mode reveals two flows missing from the needed list: a printer sending scans to a file share and phones fetching configuration from the provider. Both are added to the flows list and rules.

In monitor mode, rules log what they would block without blocking it. Reviewing these logs reveals needed flows missing from the model, which are added before enforcement.

Common findings include printers reaching a print server in another office, a forgotten scheduled backup, and devices using unexpected DNS servers. Each is checked with the service owner before being approved as a needed flow, because some findings reveal behaviour that should stop rather than be allowed.

28.4 Enforcement

After a week with no unexpected denies, enforcement is enabled.

Enforcement switches rules from monitoring to actually blocking. It is scheduled for a quiet period, with staff on hand, a tested rollback, and a contact route for users who find a service broken. After switching, engineers watch denied-connection logs closely for a few days. Any unexpected block of a legitimate flow is investigated, the flow model updated with approval, and the rule corrected, rather than adding a broad emergency exception.

Readdressing devices

Moving devices into new subnets is the most disruptive part of migration. Devices using automatic addressing simply receive new addresses after reconnecting, but printers, phones and cameras with fixed addresses need manual changes. Kofi and the engineers prepare a list of fixed-address devices from the inventory, schedule their changes in the migration window and test each one afterwards. Devices that cannot be reached are noted for a follow-up visit rather than delaying the whole migration. The updated inventory, with new addresses, is saved after each window so documentation matches the deployed network.

Rollback plan

Each migration window has a rollback plan: the previous switch and firewall configurations are saved, and reverting takes about fifteen minutes. A decision point is set halfway through the window: if critical tests fail by then, the team rolls back rather than troubleshooting under pressure. For the pilot, the decision point passes without issues, but having it agreed in advance keeps the team calm and protects services if something goes wrong. The saved configurations are checked to load correctly in the lab before each window, so rollback is known to work.

Worked example

The pilot completes with no service interruptions reported.

Synthetic case. Events are synthetic.

Errors and limits

Skipping monitor mode risks blocking needed but undocumented flows.

Exercises

Synthesis

Phased migration with monitor mode reduces risk.

Continue studying — chapter 28 of 50

← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →