A security engineer is redesigning the network architecture for an automated logistics center. The facility incorporates smart building controllers (HVAC, environmental sensors, and smart lighting) that must continuously transmit status metrics outbound to a cloud management service. However, corporate compliance requires that these controllers must be strictly prohibited from initiating connection requests to the internal database servers or corporate workstations hosting sensitive supply chain data. Which of the following network architecture strategies best fulfills these requirements while reducing lateral movement risk?
- Place smart building controllers into a dedicated microsegmented VLAN with firewall policies permitting restricted outbound traffic to the cloud service while blocking East-West traffic to internal corporate zones.Cevap
- BConsolidate smart building controllers and corporate databases on a unified internal network segment protected by a single perimeter next-generation firewall.
- CCompletely air-gap the smart building controller network from all internal and external networks, relying on daily manual USB data exports for cloud analytics.
- DDeploy a passive network intrusion detection system (IDS) at the switch core to block unauthorized connection attempts originating from the smart building controllers.
Cevap
Place smart building controllers into a dedicated microsegmented VLAN with firewall policies permitting restricted outbound traffic to the cloud service while blocking East-West traffic to internal corporate zones.
Placing smart controllers into a microsegmented VLAN with specific firewall egress rules satisfies both requirements: it allows outbound telemetry to the vendor's cloud service while preventing lateral (East-West) traffic to internal database servers and corporate workstations.
Adım Adım Çözüm
Anahtar Kavram
Network Microsegmentation and East-West Traffic Isolation