Networks, endpoints and the cloud
Attackers who get one foothold try to move to everything else. This lesson shows the controls that stop that spread: networks split into segments behind default-deny firewalls, patching driven by an asset list and real-world exploitation, endpoints that record what runs on them, and a cloud account where you know exactly which half of the security job is yours.
By the end you can
- Split a store network into segments and say which segment may talk to which, and why
- Read and write firewall rules that deny by default, and explain first-match ordering
- Rank a list of vulnerabilities by exposure and known exploitation instead of score alone, and plan a patch rollout for hundreds of devices
- Explain what EDR records, what isolating a host does, and why staff should not be local admins
- Use the cloud shared-responsibility model to find the misconfigurations that are your job, and query for one of them
The everyday picture
Picture a big supermarket building. Shoppers walk freely on the shop floor. The stockroom needs a staff badge. The cash office, where the day's takings are counted, has its own locked door, and only two people have the key. A guard at the loading bay checks every delivery against a list and turns away anything that is not on it. Cameras record the corridors, and if someone forces the cash office door, the guard can lock that corridor while the police come.
Now picture that the building is rented in a shopping mall. The mall owner looks after the roof, the walls, the fire doors and the main entrance. But the mall owner does not decide who gets keys to your cash office, and if you leave the back door propped open, that is on you. Networks, endpoints and the cloud work the same way: rooms with doors between them, a guard with a list, cameras on every device, and a landlord who secures the building while you secure what you put in it.
Segmentation: walls inside the network
In a flat network every device can reach every other device. That is convenient, and it is exactly what an attacker wants. In How breaches really happen you saw that most breaches start with one small foothold: a phished laptop, a camera with a default password, a guest phone. On a flat network that foothold can talk straight to the most valuable machines. Moving from the first device to others is called lateral movement, and segmentation is the main control against it.
Network segmentation splits the network into zones and puts a firewall between them. Inside a building this is usually done with VLANs, so the same cables and switches carry several separate networks. Traffic between VLANs has to pass the firewall, which allows only what you listed.
A Mangrove store has five kinds of devices, and they have very different jobs:
- Tills and card terminals handle card payments. They need to reach the payment provider and Mangrove's POS servers, and nothing else.
- Handheld scanners and the back-office PC run the Store app and the back office. They need Mangrove's APIs over HTTPS.
- Cameras and the video recorder need to reach each other and the security team's viewing screens.
- Guest Wi-Fi is for shoppers' phones. It needs the internet and nothing inside the store.
Group devices by what they need to reach and how much you trust them, then allow only those paths. The tills deserve the strongest walls because of the card data environment (CDE). The card industry's security standard, PCI DSS, applies to everything in the CDE and to anything that can connect to it freely. On a flat network that is every device in every store. Segmenting the tills does not by itself make you compliant, but it shrinks the part of the estate the rules apply to, and a small CDE is far easier to protect and to audit.
Quick check
A store's video recorder runs old firmware with a known flaw. Which change most limits the damage if an attacker takes it over?
A camera zone that cannot reach other zones turns a takeover into a dead end. The guest network is reachable by anyone in the store, so it is a worse home for the recorder. A better password helps but does not fix a firmware flaw, and pulling more devices into the CDE grows the area you must protect instead of shrinking it.