Chapter 11 — Networks and protocols

Chapter 11 — Networks and protocols

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Zones and boundaries"]
  N2["11.2 Remote access paths"]
  N3["11.3 Segmentation evidence"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Zones and boundaries"]
  N2["11.2 Remote access paths"]
  N3["11.3 Segmentation evidence"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 Zones and boundaries]
    |
    v
[11.2 Remote access paths]
    |
    v
[11.3 Segmentation evidence]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) map network zones to governance scope; (2) assess remote access paths; (3) relate segmentation to compliance requirements.

11.1 Zones and boundaries

Nadia maps Ardwell's network into zones: the corporate office network, the customer payment environment, the control-system network and a zone for vendor remote access. Each boundary between zones is a place where traffic can be controlled and logged. Governance needs this map because scope decisions depend on it. For example, PCI DSS v4.0 applies to the cardholder data environment and connected systems, so good segmentation keeps the payment zone small and reduces the number of systems subject to its requirements. A vendor remote access zone with its own boundary also lets Ardwell log every vendor session at a single point.

11.2 Remote access paths

Vendors maintain control-system equipment over remote connections. Nadia traces each path: from the vendor's site through the internet to Ardwell's remote access gateway, then to a jump host and finally to the equipment. She notes which hops require multi-factor authentication, which are logged and who approves each session. One vendor uses a direct connection that bypasses the jump host. She records it as a finding, because a path without logging or approval breaks the governance assumptions behind the control design. Prof. Brenner asks what evidence the direct connection leaves behind, and Nadia finds none, which is why it cannot be audited at all.

11.3 Segmentation evidence

Claiming segmentation is not enough; it must be demonstrated. Nadia learns that assessors expect evidence such as firewall rule reviews and tests showing that traffic cannot cross boundaries it should not. She writes a test plan to verify that the corporate network cannot reach the control-system network directly. She also notes that segmentation must be retested after changes, because one new firewall rule can quietly connect zones. The test plan becomes evidence for both internal governance and external assessments. Running the test after every firewall change ties segmentation evidence to change management rather than to an annual calendar.

Worked example

Nadia maps four network zones, traces vendor paths, finds a bypass and plans segmentation tests as evidence.

Synthetic case. Ardwell's network is synthetic; PCI DSS v4.0 is real.

Errors and limits

Network diagrams drift from reality. Tests show only what was tested.

Exercises

• EX031 — Four zones. Which four zones did Nadia map? Rubric: 3 = corporate, payment, control-system and vendor access;; 2 = four;; 1 = vague;; 0 = none.
• EX032 — Bypass finding. Why was the direct vendor connection a finding? Rubric: 3 = it bypassed logging and approval;; 2 = bypass;; 1 = vague;; 0 = none.
• EX033 — Retesting. When must segmentation be retested? Rubric: 3 = after changes such as new firewall rules;; 2 = after change;; 1 = never;; 0 = none.

Synthesis

Network maps define scope, and segmentation must be demonstrated with evidence.

Continue studying — chapter 11 of 50

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →