How can we create a secured, segmented network among multiple buildings when all the data has to go through a single cable?

Background: I work for a non-profit organization that has 5 buildings on one campus. We do not have an IT department. Due to various security concerns I see with the current arrangement, I am trying to devise a way we can make the network more efficient and secure. I am a software engineer, not a network engineer or network security expert.

Current parameters:

  1. everything shares a single connection to the internet.

  2. the LAN is not segmented.

  3. all devices have equal access and each device can see all other devices.

  4. each room has one or more cabled network ports.

  5. multiple wireless routers/access points exist.

  6. one building contains the main service entry for the buried cable. Other buildings connect to it via fiberoptic (1 cable per building)

  7. one PC in each of two buildings handles credit card transactions and therefore falls in scope of PCI compliance requirements.

  8. One Windows server handles DHCP and file storage for most users.

My understanding is that the credit card PCs need to be segregated away from the rest of the network to avoid all the office PCs being classified as "connected devices" under PCI-DSS.

At minimum, I would like to see the network provide a secured segment for PCI-DSS affected devices, a subnet for internal sensitive data such as accounting and personnel, and restrict visitors' connections to internet access only.


The first (easy) part of the answer is VLANs and ACLs. There you go; that's your general guidance.

The rest of it depends on exactly which PCI requirements you fall under. You might need to implement an IDS/IPS - you might not. You might need to implement something like Tripwire - you might not.

So, you should contract out to a qualified IT services outfit, with experience with PCI. For this kind of audit, you need to know what to do, and explain why doing it fits the auditing criteria.

/Edit - It may just be cheaper to replace the PCs that handle credit card transactions with card readers, than to try to bring your LAN to PCI spec. Of course, there's a number of things within that spec that are good practice anyway. So, yeah - hire someone who can advise on and implement your "I gotta" and "I wanna" lists.

  • Thank you. VLANs had been mentioned as an option but I have seen conflicting opinions on their desirability. It seems that regardless of the variance, adding VLANs would be better than our current situation. As for PCI requirements - I have done a lot of research and talked to a lot of "qualified" people and get so many conflicting answers I don't know where to start. – Paul S. Oct 13 '11 at 20:10
  • 1
    Well, if you don't use VLANs, you need separate cabling for only the connected devices, or end-to-end encryption and enough verbiage to be able to call it "compliant" with whatever your auditor is grading you on. – mfinni Oct 13 '11 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.