Network Segmentation

The radio in a 2014 Jeep Cherokee did more than play music. It ran the dashboard screen, the navigation and the hands-free phone, and it had a cellular connection of its own, so that the car could reach the internet. Two security researchers, Charlie Miller and Chris Valasek, showed in July 2015 what that connection could be used for. Working from a laptop miles away, they reached the radio over the cellular network and took it over. Then, through the radio, they sent commands to the computers that run the car itself. With a reporter for Wired driving the Jeep on an interstate in St. Louis, by arrangement, they turned on the wipers and the air conditioning and then cut the transmission, leaving him slowing down in traffic. In later tests they disabled the brakes at low speed and steered the car while it was in reverse.
A black Jeep Cherokee SUV with black wheels in a white-walled showroom on a checkered tile floor, seen from the front left side.
A 2015 Jeep Cherokee, the same generation as the one in the demonstration. Photo: HJUdall, CC0, via Wikimedia Commons.
The inside of an SUV seen from between the front seats: a steering wheel with a Jeep badge on the left, and a dark touchscreen set between two air vents in the middle of the dashboard, with climate controls and the gear selector under it.
The dashboard of a 2022 Cherokee, a later model of the same generation. The touchscreen in the middle belongs to the radio, the unit that in the 2014 model also held the cellular connection. Photo: deathpallie325, CC BY-SA 4.0, via Wikimedia Commons (cropped).
An opened metal case holding a green circuit board covered with black chips, one marked Siemens, with a black connector strip and a row of metal spring clips along its left edge and a black sensor block at the top.
The inside of the engine computer from a Volkswagen Golf diesel: a circuit board with its own processor, memory and sensors. Photo: Cschirp, CC BY-SA 3.0 DE, via Wikimedia Commons.
A radio could reach the brakes because it was itself on the car's internal networks. A modern car's engine, brakes, and steering are run by small computers that talk over those networks, and the radio sat on them so its screen could show the car's settings and change some of them, such as the heating and air conditioning. Inside the radio, the part that talked to the cellular network couldn't send commands to the car. A second chip could, and it accepted new software from the first without checking where it came from. The researchers rewrote that chip's software, and from then on the radio's link to the internal network was their link too. The part of the car that faced the outside world and the parts that controlled it weren't separated well enough.
The cellular network: the researchers' laptop, miles away. Then the radio's cellular part: faces the outside world; can't send commands to the car. New software, unchecked. Then the radio's second chip: can send commands to the car. Then the car's internal networks: engine, brakes, steering, transmission.
The researchers' route from the cellular network to the parts that run the car.
The researchers had been sharing their findings with Chrysler for about nine months, and the company had a software fix ready before Wired published its account of the drive. Chrysler recalled about 1.4 million vehicles to update the radio's software. Sprint, whose cellular network the radios used, also blocked the kind of traffic the researchers had sent, so a car's radio could no longer be reached that way over the cellular network. In August 2015, Miller and Valasek presented the work at the Black Hat security conference in Las Vegas.
A head-and-shoulders portrait of a man with thinning short hair and blue eyes, in a light jacket over a dark T-shirt, against a white background.
Charlie Miller, one of the two researchers who took over the Jeep, at the Infiltrate security conference in 2012. Photo: Alexander Klink, CC BY 3.0, via Wikimedia Commons.

The school's plan

The high school's network began the year as one flat network: student laptops, staff computers, the file server, the hallway cameras, and the heating controls could all reach one another. The earlier lessons found what that allows, from the flooded switch to the shared Wi-Fi passphrase. The figure shows how the network will be split.
A diagram. The internet connects to an outer firewall. Behind it is a screened subnet holding the school website and the parent portal. An inner firewall separates the screened subnet from four internal segments, each with its own address range: Staff (staff computers and the file server), Students (student laptops and lab desktops), Cameras (hallway cameras and their recorder), and Building (heating and bell controls). Firewall rules between segments: Students may reach the internet and the website, but not the Staff segment. Cameras may reach only their recorder. Building reaches nothing outside its segment.
The high school's network after segmentation.
The website and the parent portal have to answer anyone on the internet, so they get a segment of their own, between two firewalls. The outer firewall allows the public to reach those two servers and little else. The inner firewall decides what, if anything, may cross from their segment into the school's own network, so the servers anyone can reach never sit beside the ones only staff should.
Inside, each group of devices gets its own range of IP addresses, a subnet, and the firewall between the ranges decides what may cross. A student laptop that picks up malware can reach the internet and the website, but the rules give it no path to the staff segment.
The segments don't all get the same rules, because they don't hold the same things. The cameras come first: what, if anything, should their segment be able to reach?
The camera segment needs to reach only the recorder that stores its video. A camera has no reason to browse the internet or open a file on the staff server, so the camera segment has the narrowest rules for what it may reach, and a camera that's taken over finds almost nowhere to go. The student segment is looser, since students need the internet. The staff segment has the narrowest rules for what may reach it, and the building controls reach nothing outside their own segment.

VLANs across the building

The plan's segments don't follow the building's wiring. Hallway cameras hang on every floor, and each plugs into whatever switch serves that hallway, alongside classroom computers. The IT staff don't rewire anything. They set the switches up with VLANs, virtual local area networks: every port with a camera on it, on every floor, is assigned to the camera segment, the ports students use to the student segment, and each teacher's desk port to the staff segment. The switches keep those groups apart as if each had a network of its own. Anything that has to cross from one to another, such as a camera's video going to the recorder, leaves the switch and passes through the firewall, which applies that segment's rules.
Port security, the setting that closed the robotics lab jack, goes on as well. It is set so that every port, in the classrooms and the labs alike, learns only a few addresses before it stops taking new ones, and the unused jacks are switched off.
Sources: Andy Greenberg, "Hackers Remotely Kill a Jeep on the Highway, With Me in It," Wired (July 21, 2015); Fiat Chrysler Automobiles, recall announcement (July 24, 2015); Charlie Miller and Chris Valasek, "Remote Exploitation of an Unaltered Passenger Vehicle" (August 2015).