Segment an IoT network that cannot be patched

applied · 50 min · Objective 4.1

Task

Design and implement containment for a class of device you cannot secure directly — cameras and sensors that run old firmware and will never be updated. Segmentation is the answer to "we cannot fix the device", and this is the scenario the exam uses to ask about it.

Steps

  1. State the threat precisely. The camera has a known unauthenticated vulnerability, no patch exists, and it must keep working. You cannot fix the device, so you change what it can reach and what can reach it.
  2. Write the policy from the device's actual requirements, not from convenience. A camera needs: NTP to one server, DNS to one server, and a video stream to one recorder. It needs nothing else, including no internet access.
  3. Implement it as an allowlist. Default deny in both directions for 192.168.40.0/24, then permit exactly those three flows by destination address and port.
  4. Test the permitted flows work and — more importantly — test the denied ones fail. From the camera namespace, attempt to reach the internal subnet, the DMZ and an external address. All three must fail.
  5. Then test the containment in the other direction: from internal, confirm you can reach the camera for administration while the camera still cannot reach you. Asymmetric access is the whole design.

Verify

sudo iptables -L FORWARD -n -v | grep -E "192.168.40"
sudo ip netns exec cam ping -c 1 -W 2 192.168.10.10; echo "cam to internal exit $?"
sudo ip netns exec cam nc -z -w 3 192.168.20.10 123; echo "cam to ntp exit $?"
ping -c 1 -W 2 192.168.40.10; echo "internal to cam exit $?"

The camera must fail to reach internal, succeed to reach its NTP server, and be reachable from internal. Those three results together are the containment working; any one of them alone proves nothing.

Notes

The exam scenario usually adds a twist worth anticipating: the vendor's management software needs cloud access for firmware updates and analytics. That turns a clean "no internet" rule into a decision, and the defensible answer is a single permitted destination with a documented exception and a review date, not a general internet permit.

The principle underneath is least privilege applied to a network segment rather than to a user. Ask what the device must reach to do its job, permit exactly that, and deny the rest — including the lateral movement that makes one compromised camera into a foothold on everything.

Two related ideas the objective names. Microsegmentation takes this to the individual workload rather than the VLAN, enforced by the hypervisor or by host firewalls. And an air-gapped network is the extreme end: no connection at all, which is genuinely effective and genuinely inconvenient, and is defeated in practice by the USB stick somebody uses to move files across.