The segmentation that existed only on the diagram
The card data environment was isolated in every document we were shown. It was two hops from the warehouse Wi-Fi.
Illustrative write-up. Details are composited and anonymised across engagements of this type. Figures are representative rather than drawn from one named customer.
The brief
A multi-site retailer approaching a PCI-DSS assessment needed segmentation validation: proof that the cardholder data environment could not be reached from the rest of the corporate network. They had the network diagrams, the firewall rules and a previous assessor's sign-off.
We were given a wired port in a back office and the position of an attacker who had already compromised one ordinary workstation. No credentials.
What we found
The documented boundary was real. The firewall between the corporate VLAN and the card environment was configured correctly, and traffic we sent directly at it was dropped exactly as designed.
The problem was a third path nobody had drawn. A management VLAN, created years earlier for switch administration, was trunked to both sides. It appeared on no diagram because it carried no user traffic, and it had been excluded from the previous assessment's scope for the same reason.
- The warehouse Wi-Fi controller sat on the management VLAN and accepted connections from the guest range
- Its administrative interface still used vendor default credentials
- From the controller, the management VLAN reached a switch with a route into the card environment
- Two hops from an unauthenticated wireless client to a host in scope
Why it mattered
For PCI-DSS specifically, a reachable path means the corporate network is in scope, which changes the size of the assessment considerably. For the business generally, it meant that anyone who could reach the warehouse car park could reach systems handling card data.
How it was fixed
- The wireless controller's default credentials were changed the same afternoon
- The management VLAN was removed from the trunk on the card environment side
- Management access was moved behind a jump host with its own authentication
- Scoping for the assessment was redone to include every VLAN present on a trunk, not only those carrying user traffic
We retested a fortnight later. The path was gone, and a second attempt to reach the environment from three different starting points found nothing.
The pattern worth stealing: scope segmentation testing by what is physically trunked, not by what appears on the diagram. The diagram records intent. The switch configuration records reality, and they drift apart quietly over years.
Is your boundary where you think it is?
Segmentation validation is a short engagement with a binary answer. We will tell you honestly if you need less than you expected.