Physical security, segmentation and deception

Why this matters

This finishes objective 4.1 with the material that ties security to network design: segmentation, the device categories that force it, and the compliance regimes that require it.

Segmentation is the practical heart of it. Most of what a network engineer actually contributes to security is deciding what may reach what — and the device types in this lesson exist as named categories precisely because they are the ones that must be separated.

The lesson

Network segmentation enforcement

Network segmentation enforcement means dividing the network into zones and actually controlling traffic between them. The second half is the point: a VLAN on its own separates broadcast domains, not access. Without a firewall or ACL between them, routing happily carries traffic from one to the other.

Segmentation limits lateral movement. An attacker who compromises a reception PC should not be able to reach the finance database, and the control that stops them is a rule between segments rather than anything on either host.

It also reduces compliance scope, which is a real commercial argument: if cardholder data lives in one tightly controlled segment, the PCI DSS audit covers that segment rather than the whole estate.

The mechanisms, from coarse to fine: VLANs with ACLs between them; firewalls at zone boundaries; microsegmentation, applying policy per workload rather than per subnet; and the zero-trust model from domain 1, where the segment boundary stops being the only decision point.

Guest networks

A guest network is the simplest and most common segmentation. Visitors get internet access on a separate SSID and VLAN, isolated from internal systems by an explicit rule, rate-limited, and with client isolation so guests cannot see each other.

The reason it belongs under security rather than convenience: a visitor's laptop is an unmanaged, unknown-state device that you have invited inside your building. Treating it as hostile and giving it nothing but a path to the internet is the correct posture.

IoT, IIoT and OT

Three device categories that share one characteristic: they cannot be secured the way a normal computer is, so the network has to compensate.

Internet of Things (IoT) and Industrial Internet of Things (IIoT) covers network-connected devices that are not general-purpose computers — cameras, badge readers, thermostats, sensors, smart displays, and in the industrial case instrumented machinery.

Their common problems: shipped with default credentials, rarely or never patched, often unable to run any security agent, frequently reachable from the internet by default, and bought by departments who never told IT. They have been the entry point in a long list of real breaches, and the Mirai botnet was built almost entirely from them.

Supervisory control and data acquisition (SCADA), industrial control System (ICS), operational technology (OT) is the industrial control layer — the systems running manufacturing lines, power distribution, water treatment and building services.

These are harder still, for reasons worth understanding rather than memorising:

• They run for decades. A controller installed in 2005 is still in service and still runs an operating system that went end-of-support years ago.
• Availability outweighs confidentiality. Stopping a production line or a water plant to patch is not a casual decision, and in some cases a reboot has physical safety consequences.
• Their protocols were designed for isolated networks and often have no authentication at all.
• Consequences are physical. A compromise damages equipment or endangers people, not just data.

The answer for all of these is the same and it is the exam answer: segment them aggressively. Put them on their own networks, allow only the specific flows they need, do not let them reach the internet, and monitor them closely. Where a device cannot be patched, isolation is the compensating control.

Locks

Locks are the baseline physical control — on server room doors, on racks, on wiring closets, on individual equipment.

They matter in a networking exam because physical access is administrative access. Reaching a switch's console port usually permits password recovery, which means a factory reset and full control. Reaching a patch panel means patching yourself into any VLAN in the building. No logical control survives an attacker with unsupervised physical access.

Note the earlier distinction: a lock is preventive, a camera is detective. A question asking which control prevents unauthorised access to the equipment room wants the lock.

Honeynets

A honeynet is an entire decoy network of honeypots, imitating a realistic environment rather than a single host.

Where a single honeypot catches a scan, a honeynet lets you watch an intrusion develop — how an attacker moves between systems, what they look for, which tools they bring. That intelligence is its value.

The same caution as before, amplified: it must be genuinely isolated from production, and deploying one is a documented decision rather than a casual experiment.

Security terminology: vulnerability, exploit and threat

Three words used interchangeably in conversation and precisely on the exam.

A vulnerability is a weakness that could be taken advantage of — an unpatched service, a default password, a misconfigured ACL, an unlocked door.

An exploit is the method or code that takes advantage of a vulnerability. The vulnerability is the unlocked window; the exploit is climbing through it. A vulnerability with no known exploit is less urgent than one with working exploit code in circulation, which is why "actively exploited" changes patching priority.

A threat is the potential source of harm — an attacker, malware, a disgruntled employee, a flood. Threats exist whether or not you are vulnerable.

Combined, as the previous lesson set out, they produce risk.

The CIA triad

Confidentiality, Integrity, and Availability (CIA) triad is the framework underneath every security control, and each leg has its own answer:

Confidentiality — only authorised parties can read it. Provided by encryption, access control and segmentation.

Integrity — the data has not been altered, and you can tell. Provided by hashing, digital signatures, checksums and the frame check sequence at layer 2.

Availability — it is there when needed. Provided by redundancy, high availability, backups, DR, and defences against denial of service.

The triad is useful for classifying: a DDoS attacks availability, eavesdropping attacks confidentiality, and an on-path attacker altering traffic attacks integrity. Exam questions frequently ask which leg a given control or attack concerns.

It is also useful because the legs conflict. Encrypting everything helps confidentiality and can hurt availability if a key is lost. The OT systems above prioritise availability so strongly that confidentiality controls are sometimes declined. Security work is choosing the balance, not maximising all three.

PCI DSS, GDPR and BYOD

Payment Card Industry Data Security Standards (PCI DSS) applies to anyone storing, processing or transmitting payment card data. It is a contractual standard rather than a law, enforced by the card brands, and it is unusually prescriptive about networking: segment cardholder systems, restrict access on a need-to-know basis, encrypt transmission across public networks, change vendor defaults, and maintain firewall rules with documented justification.

Its practical effect is the segmentation argument above — reducing the scope of the cardholder data environment reduces the cost of compliance.

General Data Protection Regulation (GDPR) is EU law covering personal data of people in the EU, regardless of where the organisation is. Its network-relevant requirements are encryption in transit and at rest, restricted access, breach notification within 72 hours, and constraints on transferring data outside the EU — the data locality issue from the previous lesson.

Bring your own device (BYOD) is the policy of permitting personal devices on the corporate network. It is popular with users and difficult to secure, because the device is not owned, not fully controlled, and shared with family members and personal applications.

Approaches: MDM (mobile device management) to enforce encryption, screen locks and remote wipe; containerisation, keeping corporate data in a managed area that can be wiped without touching personal data; NAC to check posture before admitting a device; and putting BYOD devices on a separate segment with access only to the specific applications they need.

The exam angle is usually the tension: a personal device cannot be trusted like a managed one, so it is segmented and its access is limited — which is the same conclusion the IoT and guest sections reached, by a different route.