Security: Threats & Defense · Study deck
Network Segmentation for IoT
A lobby camera needs to reach its recorder and time service, but it does not need a route to payroll laptops.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: The next choice is defensible only if the reader can see that an allowed-flow record turns a vague rule into source, destination, protocol, purpose, owner, evidence, and retest trigger.
- Explain: Deny camera-initiated access to user laptops, other camera management pages, and the public internet unless a documented update route is required. “IoT VLAN” does not express these individual flows.
- Explain: For camera C12, allow outbound video to recorder R2 on the approved service, time synchronization to the named server, and management only from the administration zone.
- Explain: Administrators may need a controlled jump host.
Major section
Trace the Camera Across Zone Boundaries
Zone names are only labels until controls restrict traffic between them.
- Deny camera-initiated access to user laptops, other camera management pages, and the public internet unless a documented update route is required. “IoT VLAN” does not express these individual flows.
- Segmentation limits blast radius when a device is compromised.
- Discovery and operations need design too.
Major section
Trace the Camera Across Zone Boundaries (continued)
An unknown device appearing in the camera zone should receive no broad default access.
- Broadcast-dependent setup may not cross a routed boundary.
- Administrators may need a controlled jump host.
- Monitoring should identify denied scans without flooding logs with expected noise.
- Emergency access should be time-limited and removed after the incident.
Major section
Trace the Camera Across Zone Boundaries (continued)
Inventory and segmentation must agree.
- A moved or repurposed device needs a reviewed role change rather than retaining old routes.
- An outbound camera session may need replies without allowing an office host to begin a new inbound session.
- A temporary commissioning rule that remains for years can defeat the intended zone boundary.
Major section
Trace the Camera Across Zone Boundaries (continued)
DNS can reveal or redirect destinations, so define which resolver is allowed and what happens if it fails.
- During an outage, keep the boundary closed by default and preserve local recording if that is the camera's safe mode.
- A firewall restart should restore the approved policy before general forwarding begins.
- For camera C12, allow outbound video to recorder R2 on the approved service, time synchronization to the named server, and management only from the administration zone.
Major section
Start With the Story: One Camera Should Not Reach Everything
A zone label has not limited the camera until the needless path fails and the failure can be seen.
- A broker means a service that receives and forwards named messages.
- A gateway means a device or service that joins two message paths.
- Segmentation limits which of these systems a device can reach; it does not prove trust.
- This runway does not prove the camera or allowed service is safe.
Major section
Start With the Story: One Camera Should Not Reach Everything (continued)
The deeper sections explain zones, flows, firewall rules, identity-aware controls, monitoring, exceptions, and change evidence.
- A facilities team connects a new camera so operators can watch a loading bay.
- The camera only needs to send video metadata to a gateway and receive updates from a management service.
- Once that record exists, VLANs, firewall rules, microsegmentation, and zero trust boundaries become implementation choices that can be checked against evidence.
Major section
Practitioner: Zones, Allowed Flows, and Default Deny
The next choice is defensible only if the reader can see that an allowed-flow record turns a vague rule into source, destination, protocol, purpose, owner, evidence, and retest trigger.
- Figure: The acceptance loop names the evidence needed here: classes,: Monitor, and after changes.
Deck summary
Key takeaways
Zone names are only labels until controls restrict traffic between them.
- An unknown device appearing in the camera zone should receive no broad default access.
- Inventory and segmentation must agree.
- DNS can reveal or redirect destinations, so define which resolver is allowed and what happens if it fails.
- A zone label has not limited the camera until the needless path fails and the failure can be seen.
Retrieval practice
Recall check 1 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q1What does network segmentation actually prove about an IoT deployment?
Show answer
Answer: C Segmentation controls who can reach what.
Retrieval practice
Recall check 2 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q2A team says its IoT network is segmented because all IoT devices share one VLAN. Cameras, sensors, and access-control readers can still reach each other in that VLAN. What is the best review finding?
Show answer
Answer: A Segmentation evidence must show both allowed paths and denied lateral paths, especially between device classes with different functions and risks.
Retrieval practice
Recall check 3 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q3Why can placing all IoT devices in a single VLAN fail to stop a compromised camera from reaching sensors in the same VLAN?
Show answer
Answer: D Intra-VLAN traffic is typically unrestricted; controlling it needs ACLs, private VLANs, host firewalls, or finer microsegmentation.
Print reference
Answers
Answer key.
- C · Segmentation controls who can reach what.
- A · Segmentation evidence must show both allowed paths and denied lateral paths, especially between device classes with different functions and risks.
- D · Intra-VLAN traffic is typically unrestricted; controlling it needs ACLs, private VLANs, host firewalls, or finer microsegmentation.