Unit 2: Addresses and subnets · Lesson 7 of 7 · 22 min
Case file: one network, every site
Read an address plan where every office can reach every other on every port, count the paths a worm would use and plan the segments.
case file
Maersk and NotPetya
A.P. Moller-Maersk · 2017
In June 2017 the destructive NotPetya malware, spread initially through a compromised update of Ukrainian tax software, tore through networks worldwide and crippled shipping giant Maersk. Maersk reinstalled about 4,000 servers, 45,000 PCs and 2,500 applications in roughly ten days while running much of its business manually. The company estimated losses of $250 million to $300 million, and its chairman described its prior security as 'basically average'.
What went wrong
A flat, highly connected Windows network where self-propagating malware could spread rapidly, combined with dependence on systems that had to be rebuilt from scratch.
What would have stopped it
- Segment networks so that a compromise in one country or business unit cannot spread globally.
- Maintain offline/immutable backups of critical systems, including identity infrastructure such as domain controllers, and test full rebuilds.
- Patch SMB vulnerabilities and restrict administrative credential reuse to limit lateral movement.
- Practice manual business continuity procedures for a total IT outage.
What defenders could have seen
- Sudden spike in SMB connections and remote service creation across many hosts.
- Mass endpoint alerts for disk-encryption or MBR-modification behavior.
- Credential-dumping tool detections followed by rapid lateral logons.
sourcessecurityweek.comitpro.com
mission
- You are
- The network architect asked to review the global address plan.
- Situation
- corp.example built one flat network for four offices in 2019, with no filtering between sites. This lab is modelled on the Maersk NotPetya case, where a flat network let destructive malware spread worldwide.
- Goal
- Measure how open the plan is and propose site boundaries that would stop a worm at the first office.
- Hand in
- The number of open inter-site SMB paths and a per-site segment plan.
Bulkheads in a ship
Read the plan as built
Every site has its own /20, which looks tidy. What matters is the line about traffic between sites.
cat current-plan.txt
corp.example global network, as built in 2019
10.0.0.0/16 every site, one routed domain
10.0.0.0/20 London head office
10.0.16.0/20 Rotterdam port office
10.0.32.0/20 Singapore office
10.0.48.0/20 Kyiv finance office
between sites: any to any, no filtering
admin accounts: one domain admin group for every site
you should see Any site can reach any other site on any port, and one admin group covers everything.
Count the paths by port
reach.csv lists what each site may open at every other site. Worms like NotPetya spread over SMB (445) and remote procedure calls (135), and attackers move by remote desktop (3389).
grep -c ',445,allow' reach.csv 12 cut -d, -f3,4 reach.csv | sort | uniq -c 12 135,allow 12 22,deny 12 3389,allow 12 443,allow 12 445,allow 1 port,verdict
you should see All 12 site pairs allow SMB, RPC and remote desktop. Only SSH is blocked.
See what one office can reach
Pick the office a supply chain attack would hit first: the one that runs local finance software.
grep '^kyiv,' reach.csv | grep allow | cut -d, -f2,3 | head -n 4
london,135
london,443
london,445
london,3389
you should see From the Kyiv office, SMB and remote desktop reach straight into head office.
Size one site as its own segment
Each site already has its own /20, so the boundary is simple to draw: filter at the site edge instead of re-addressing.
ipcalc -nb 10.0.48.0/20 | grep -E 'Network|Hosts'
Network: 10.0.48.0/20
Hosts/Net: 4094 Class A, Private Internet
you should see 4094 hosts per site. The plan needs rules, not new addresses.
defender tip Segment along the lines you would want to rebuild separately: by site, by business unit and by tier (users, servers, identity).
Between sites
any site -> any site tcp 135, 445, 3389 allow admins: one group for every site
One infected office can reach every server worldwide.
site -> site tcp 443 to named services allow everything else drop, log admins: per site, no reuse
A worm stops at the site edge and stolen admin rights stay local.
What a defender takes away
- 1A flat network turns one infection into a global outage.
- 2Block SMB, RPC and remote desktop between sites unless a named service needs them.
- 3Separate admin accounts per site so stolen credentials cannot travel either.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.