Capstone: designing and defending a segmented network

This capstone brings the course together. You will work through the network security design for an invented organization, from understanding its business and assets, through architecture, components and secure channels, to monitoring, governance and a risk-based investment case. Along the way, the lesson shows how the Domain 4 topics connect, and it closes with strategies for answering Domain 4 questions on the exam. The organization, its people and its numbers are invented for teaching; any resemblance to a real company is coincidental.

The organization

Tamarack Freight is a mid-sized logistics company headquartered in Winnipeg, with two automated warehouses in Mississauga and Calgary, about 900 employees, a fleet of trucks with telematics units, and a customer portal where shippers book loads and track freight. It processes card payments for small customers, holds personal information about drivers and customers, and runs warehouse automation, conveyors, sorters and robotic pickers, controlled by PLCs. Its applications are split between a small headquarters data centre and a public cloud provider. Since 2020, about 40 % of office staff work from home part of the week. Its largest customers include federally regulated retailers and a bank, which send security questionnaires every year.

A recent assessment found the following. The headquarters and warehouse networks are flat, with office PCs, servers, cameras, door controllers and warehouse PLCs on the same subnets. A remote access VPN gives every user full network access, protected by passwords only. The warehouse automation vendor connects through an always-on remote desktop tool. Corporate Wi-Fi uses WPA2-Personal with a passphrase unchanged for four years. The customer portal runs in the cloud, but its database has a public IP address. Firewall rules number about 1,400, many without owners. Logs are kept on each device for a few days, and no one reviews them. There is no DMARC record, and the company has been impersonated in invoice fraud twice this year.

Step 1: understand the business and its protect surface

The first step is not technical. Before redesigning anything, the security manager meets business owners to understand what matters. For Tamarack, the critical services are the customer portal and booking system, the warehouse management system and automation that move freight, the payment flow, driver dispatch and telematics, and email and collaboration. The critical data are customer and driver personal information, payment card data, contracts and pricing. Downtime of warehouse automation costs about $45,000 an hour in missed shipments and penalties; a week-long outage could lose major customers. These facts set priorities: availability of warehouse operations and the portal, confidentiality of personal and payment data, and integrity of bookings and dispatch.

Step 2: design the zones

With priorities clear, the architect designs zones and the flows between them. At headquarters: a user zone for office devices, divided by department where useful; a server zone for internal applications; a restricted payment zone kept as small as possible to reduce the scope of payment card compliance; a management zone for network and system administration, reached only through privileged access workstations and a jump host; a building systems zone for cameras, door controllers and heating; a guest zone with internet access only; and a backup zone with immutable storage. At each warehouse: an office zone, and an OT zone structured along Purdue lines, with an industrial DMZ holding a historian replica, patch server and remote access broker, and the PLCs and HMIs below it. In the cloud: a virtual network with public subnets only for the load balancer, private subnets for the application and database tiers, and security groups allowing each tier to reach only the next.

Step 3: secure the components

Next, the design specifies how each component is secured. Access switches enforce 802.1X with EAP-TLS for managed laptops, placing devices into their zone by policy; printers, cameras and door controllers are profiled by NAC and placed in restricted segments; port security, DHCP snooping, dynamic ARP inspection, RA Guard and BPDU guard are enabled on access ports; unused ports are disabled. Corporate Wi-Fi moves to WPA3-Enterprise with EAP-TLS and protected management frames; guest Wi-Fi uses a separate SSID with client isolation and a captive portal. Internal firewalls between zones are next-generation firewalls with application identification and intrusion prevention, deployed first in detection mode. The 1,400-rule legacy rule base is replaced by a new rule base built from the documented flows, with every rule assigned an owner and review date. Network devices are managed through TACACS+ with individual accounts and MFA, configurations are backed up and checked for drift, and firmware is tracked against vendor support dates.

Step 4: secure the channels

Remote access moves from the full-network VPN to zero trust network access delivered by a security service edge provider, with phishing-resistant MFA and device posture checks; a small VPN remains for administrators, through the management zone only. Warehouses connect to headquarters and the cloud over SD-WAN with IPsec tunnels, with an MPLS link retained at the busiest site for predictable performance and still encrypted. The cloud is reached over IPsec until a dedicated interconnect is justified, and the database loses its public IP, with access only from the application tier through private subnets. Email gains SPF, DKIM and DMARC, rolled out from monitoring to reject over three months, plus a mandatory call-back procedure for payment changes. The vendor's always-on remote desktop tool is removed on day one and replaced with brokered, recorded, time-limited sessions. Telematics units connect over cellular to a dedicated cloud endpoint using mutual TLS with device certificates.

Step 5: monitor and govern

Logs from firewalls, ZTNA and SSE services, DNS resolvers, DHCP, NAC, wireless controllers, cloud flow logs and endpoint detection are sent to a SIEM, with all devices synchronized to redundant NTP sources. Flow records are kept for a year and full packet capture for seven days at the internet edge and the industrial DMZs. Passive OT monitoring sensors watch the warehouse control networks. A managed detection and response provider gives around-the-clock coverage, with documented escalation to Tamarack's on-call staff. Governance completes the design: a network security standard approved by leadership, owners for every zone and rule, change management with security review, quarterly rule reviews, annual penetration tests and segmentation tests, tested failover, and an incident response plan that maps reporting obligations under privacy law, critical infrastructure rules that may apply to customers' supply chains, and payment card rules.

Step 6: prioritize and justify

No organization can do everything at once. The security manager sequences the work by risk reduction per dollar and per week of effort, putting quick, high-impact fixes first and larger architectural projects after. A simple quantitative model helps leadership see the value. The model below simulates a year of incidents many times, using invented but plausible frequencies and impacts, before and after the program, and compares expected annual losses with the program's cost.

import random
random.seed(113)
# (name, annual rate before, annual rate after, typical loss, loss spread factor) - invented figures
risks = [
    ('Ransomware reaching warehouse OT', 0.30, 0.06, 2_500_000, 0.6),
    ('Customer database breach', 0.15, 0.04, 1_800_000, 0.5),
    ('Invoice fraud via spoofed email', 1.50, 0.30, 90_000, 0.4),
    ('Portal DDoS outage', 0.60, 0.10, 300_000, 0.5),
]
def simulate(after, years=20_000):
    total = 0.0
    for _ in range(years):
        for name, before_rate, after_rate, loss, spread in risks:
            rate = after_rate if after else before_rate
            # number of events this year: approximate Poisson by 12 monthly Bernoulli trials
            events = sum(random.random() < rate / 12 for _ in range(12))
            for _ in range(events):
                total += loss * random.lognormvariate(0, spread)
    return total / years
before = simulate(False)
after = simulate(True)
cost = 650_000
print(f'Expected annual loss before: ${before:,.0f}')
print(f'Expected annual loss after:  ${after:,.0f}')
print(f'Annual program cost:       ${cost:,.0f}')
print(f'Net annual value:            ${before - after - cost:,.0f}')

Expected annual loss before: $1,554,870
Expected annual loss after:  $328,060
Annual program cost:       $650,000
Net annual value:            $576,810

Step 7: test the design

A design is a hypothesis until it is tested. Segmentation testing, which is required at least annually for payment card environments under PCI DSS and more often for service providers, confirms that zones really are isolated, by attempting connections across boundaries that should be closed. Penetration tests and red team exercises test whether an attacker who phishes one employee can reach the warehouses or the database. Tabletop exercises test DDoS activation, OT incident response and regulatory reporting. Failover tests confirm that redundant links and firewalls work. Findings feed back into the design and the roadmap, so the network keeps improving.

Strategy for Domain 4 questions

Domain 4 questions reward a few consistent habits. First, read for the layer: decide whether the scenario is about the physical medium, local switching, routing, transport or the application, and favour controls that work at that layer. Second, read for the real requirement: confidentiality, integrity, availability, authentication or nonrepudiation, and choose the mechanism that provides it; IPsec ESP for confidentiality of network traffic, DNSSEC for integrity of DNS, SRTP for voice, DMARC for email domain authenticity. Third, prefer root causes over symptoms: segmentation over another perimeter device, replacing clear-text protocols over monitoring them, mutual authentication over hiding the SSID. Fourth, think like a manager: when asked what to do first, understanding the environment, assessing risk, involving the business and legal counsel, and following policy usually come before buying or configuring. Fifth, eliminate distractors that are true statements but do not answer the question asked.

Finally, manage your preparation. Domain 4 is about 13 % of the exam, similar to Domains 3, 5 and 7, so it deserves proportionate time; if you come from a networking background, spend more time on the domains you know least. Practise explaining each concept in plain language, because the exam's scenarios are written in business terms. And remember that the CISSP is a professional's credential: the best answer is the one a responsible security leader would choose, balancing risk, cost, law and the needs of the business.

Thinking like a manager

The capstone shows the manager's path through any network security problem: understand the business and its protect surface; design zones and flows from that understanding; secure components and channels at every layer; monitor, govern and test; prioritize by risk and explain the case in business terms. Each step depends on the one before it, and skipping the first, understanding, is the commonest reason that expensive network security projects disappoint.