How can we create a secured, segmented network among multiple buildings when all the data has to go through a single cable?
Background: I work for a non-profit organization that has 5 buildings on one campus. We do not have an IT department. Due to various security concerns I see with the current arrangement, I am trying to devise a way we can make the network more efficient and secure. I am a software engineer, not a network engineer or network security expert.
everything shares a single connection to the internet.
the LAN is not segmented.
all devices have equal access and each device can see all other devices.
each room has one or more cabled network ports.
multiple wireless routers/access points exist.
one building contains the main service entry for the buried cable. Other buildings connect to it via fiberoptic (1 cable per building)
one PC in each of two buildings handles credit card transactions and therefore falls in scope of PCI compliance requirements.
One Windows server handles DHCP and file storage for most users.
My understanding is that the credit card PCs need to be segregated away from the rest of the network to avoid all the office PCs being classified as "connected devices" under PCI-DSS.
At minimum, I would like to see the network provide a secured segment for PCI-DSS affected devices, a subnet for internal sensitive data such as accounting and personnel, and restrict visitors' connections to internet access only.