Unit Scenarios
Scenario 3A: Protecting Patient Medical Data
The Situation
As a network security engineer at Adams County Hospital, the task is securing an environment with public web app servers (appointment booking, bill payment) and an internal file server holding patient records, using two new firewalls to bring things up to HIPAA-compliant standards.
The current setup is a flat, unsegmented network with web servers and patient records sitting together, no DMZ isolation, and direct internet access reaching internal systems, meaning a compromised web server could give an attacker immediate access to patient data with nothing filtering traffic between zones.
Firewall Placement
The recommended fix is a two-firewall DMZ design: Firewall A, a next-gen perimeter firewall between the internet and a DMZ holding the web app servers, and Firewall B, a stateful internal firewall between the DMZ and the internal network holding patient records and workstations.
The perimeter firewall handles deep packet inspection and intrusion prevention for the web apps, filtering all incoming traffic. The internal firewall is what actually keeps a DMZ compromise from reaching patient data, enforcing strict rules and integrating with user authentication.
Firewall A (Perimeter) Rules
Allow inbound HTTPS (and HTTP that redirects to HTTPS) to the DMZ web servers for patient portal access. Deny inbound SSH, RDP, and Telnet from the internet entirely, blocking remote management attempts. Deny inbound access to database ports outright. Deny all inbound traffic aimed directly at the internal network, since nothing from the internet should ever reach it directly. Deny outbound traffic from the DMZ except for approved services, preventing a compromised server from calling home to an attacker. On top of these rules, add SQL injection and XSS detection, known exploit blocking, threat intelligence IP blocking, and SSL/TLS inspection.
Firewall B (Internal) Rules
Allow only a specific DMZ web server to reach the database server on its specific port, rate-limited to prevent abuse. Deny SMB file access from the DMZ to file servers entirely. Deny all DMZ traffic to the patient record subnet completely, fully isolating PHI from the DMZ. Allow medical staff workstations to reach the patient record server, but require certificate-based authentication plus MFA, with every access logged by user identity. Deny all guest Wi-Fi traffic to file servers. And finish with a default deny for everything else.
A reasonable segmentation scheme separates the DMZ, general servers (with the database and general file server), a dedicated patient record subnet for PHI, general employee workstations, medical staff workstations, and an isolated guest Wi-Fi network.
Monitoring and Compliance
Everything worth logging should be logged: denied connections, every single patient record access (a HIPAA audit requirement), authentication failures, and high-risk events like SQL injection attempts or unusual data transfers. Critical alerts should fire for repeated denials from a single source, any attempt from the DMZ toward patient records, more than 5 failed logins in 10 minutes, unusually large data transfers out of patient records, or database queries exceeding rate limits.
This setup covers the core HIPAA requirements: access controls through firewall rules and authentication, audit controls through comprehensive logging, integrity through segmentation that prevents unauthorized changes, and transmission security through HTTPS and internal encryption.
Scenario 3B: Configuring a Secure Wireless Network
The Situation
As a National Guard network technician responding to a disaster, the task is setting up secure wireless at an emergency shelter (a converted high school gym) for displaced residents, needing to provide internet access, detect and log malicious activity, and stay secure despite being a temporary, resource-constrained setup with transient users and unknown devices.
Wireless Setup
The network uses a clearly broadcast SSID like "Shelter_WiFi_Secure" so people can find it easily and so a clear name helps prevent confusion with a fake evil twin network. Encryption is WPA2-Personal at minimum, WPA3 preferred. For authentication, either a daily rotating password posted at the entrance (simple for non-technical users) or individual time-limited vouchers per resident that can be revoked for misuse (a somewhat better option). Access point settings include client isolation so devices can't see each other, a cap of 50 clients per access point, a 5 Mbps bandwidth limit per device, and a 30-minute idle timeout.
This is one place where leaving beacon frames on makes sense, even though a wireless security policy would normally disable them. A shelter network has to be easy for anyone to find, and a clearly named, visible network makes a look-alike evil twin easier to spot. The protection comes from encryption, client isolation, and the detective controls below.
Network Architecture
Traffic flows from a satellite dish through a modem, then a firewall/router, then an inline IDS/IPS, then a content filter and proxy, then wireless controllers managing access points spread around the gym, hallway, entrance, and office.
Firewall Rules
Inbound: deny everything from the internet by default, only allowing established responses to outbound requests. Outbound: allow web browsing and secure email sending and retrieval, allow DNS, deny direct SMTP to prevent spam relay, deny peer-to-peer protocols to preserve bandwidth, and rate-limit connections per IP per minute.
Detective Controls
A hybrid IDS/IPS watches for things like port scanning (rate-limits the source and alerts), connections to known malware command-and-control servers (blocks, alerts, and isolates the device), DDoS attempts (blocks the source and alerts), unusual bandwidth spikes (logs for review), and after-hours activity during shelter quiet hours (logs for review).
A web content filter blocks malware sites, phishing sites, known malicious domains, and adult content given the presence of families with children, while still allowing social media (important for people trying to stay connected), news, and bandwidth-limited streaming, with real-time threat intelligence lookups and SSL inspection (excluding banking and healthcare sites for privacy).
A SIEM pulls together data from the firewall, IDS, wireless controllers, content filter, and access points, correlating things like a malware site visit plus unusual ports plus high outbound traffic (flagging a likely compromised device for quarantine), multiple disconnects plus odd authentication patterns plus a burst of new devices (flagging a possible evil twin needing a rogue AP scan), repeated failed logins across multiple banking sites (flagging possible credential harvesting worth checking with the user), or a port scan plus internal connection attempts plus a client isolation bypass (flagging a likely internal attack needing device isolation).
Wireless intrusion detection scans all channels periodically looking for unauthorized access points, evil twins, rogue APs, or jamming, alerting if a suspicious SSID appears and comparing MAC addresses against a known-good list.
User behavior analytics track connection patterns, bandwidth use, site categories, and geographic distribution per device, alerting on sudden changes in category, big bandwidth jumps, unusual hours, or high-risk geographic connections.
Why All This Matters
Detection speed goes from hours or days without these controls down to seconds or minutes with them, for example catching malware command-and-control traffic in 5 seconds instead of letting it run unnoticed. Incident response goes from having zero visibility to having a complete timeline and identified devices, cutting a "why is the internet slow" investigation from hours of guessing down to about 3 minutes once a port scan is spotted. User protection numbers add up fast too, with dozens of blocked phishing attempts a day, over a hundred blocked malware downloads in a week, and multiple compromised devices identified and cleaned. Network availability stays high, around 99.7% uptime, since attacks like DDoS get blocked within seconds instead of taking down service for 200 residents.
On cost, adding full detective controls roughly triples the hardware cost compared to a bare firewall setup, but it also cuts daily technician workload from 8 to 12 hours down to about 3, which more than justifies the investment given the value of preventing incidents and protecting vulnerable users.
On privacy, the system monitors connection metadata, destination domains, and threat indicators, but never monitors the actual content of communications, specific URLs within a domain, personal info entered on pages, or user identities beyond anonymous MAC addresses. Logs are kept for 30 days and get destroyed once the shelter closes, with signage informing residents that monitoring is happening for security purposes.
False positive rates vary by tool, generally under 5% for signature-based detection, 15 to 25% for anomaly detection, under 2% for content filtering, and 10 to 15% for SIEM correlation, manageable for a technician handling other duties while investigating alerts, and improving over time as the system gets tuned.
A typical rollout looks like physical setup and basic configuration in the first few hours of day one, security hardening and testing over the following hours, then daily dashboard review and alert investigation throughout operation, with weekly trend review and threat feed updates, and a proper closeout process backing up logs for an after-action report, documenting lessons learned, securely wiping user data, and returning equipment.
Scenario 3C: Protecting a Network on a Naval Submarine
The Situation
As a network technician on a submarine, the task is securing three completely distinct LANs: weapons systems (torpedoes, missiles, targeting), secure operations (navigation, communications, mission planning), and crew recreation (personal email, entertainment), while making sure a compromise in one can never spread to another.
Weapons Systems LAN (Critical/Top Secret)
This one needs full physical isolation, a genuine air gap with no connection to any other network, no wireless at all, and physical cable separation. Access requires badge plus biometric authentication, a two-person integrity rule requiring two authorized people present, role-based access limited to weapons officers, and a hardware security module. On the network side: port security limiting MAC addresses, physical locks on all equipment, USB disabled entirely, and video surveillance of access points. Everything gets logged by user identity, every weapons command gets logged, anomaly detection watches for unexpected traffic, and a watch officer monitors this 24/7. The bottom line: this network has zero connections to anything else, full stop.
Secure Operations LAN (Secret)
This LAN allows limited external connectivity, but only through an encrypted satellite link with no direct internet, all external communication passing through a cryptographic gateway. Internally it's segmented into VLANs for navigation, communications, mission planning, and operations support. Security controls include certificate-based authentication plus MFA, a stateful firewall between operations and external comms, network IDS/IPS watching everything, application whitelisting, and encryption for all classified data. Access requires a certificate, MFA, and appropriate officer clearance.
Crew Recreation LAN (Unclassified/Restricted)
This one is completely isolated from both other LANs, running on entirely separate physical infrastructure with outbound-only internet, and only available when the submarine's surfaced. Access includes content filtering for malware, phishing, and inappropriate sites, bandwidth limits per user, and no peer-to-peer protocols allowed. Devices must be pre-registered (MAC whitelist), no cameras allowed, antivirus required, and no location services. Security monitoring includes deep packet inspection, a data loss prevention system scanning for classified keywords, full activity logging, and an IPS blocking malicious traffic.
Why the Separation Matters
Without separation, malware on a personal recreational device could spread into operations, compromise navigation, and reveal the submarine's location. With genuine separation, malware picked up on the recreation LAN has literally no path to reach anything critical, and gets cleaned up at the next port with zero risk to weapons or operations systems.
Physical security backs this up too: the weapons room gets restricted access with armed security and a two-person rule, the operations center needs badge plus biometric access, and recreation areas allow general crew access. Equipment stays in locked cabinets with tamper-evident seals and regular inspections, with the weapons LAN under continuous watch officer monitoring, the operations LAN monitored by a security officer watching IDS alerts, and the recreation LAN under automated monitoring with periodic review.
Unit 3 Summary
These three scenarios show network security principles playing out very differently depending on context: the hospital scenario is about enterprise security with regulatory compliance and DMZ architecture, the shelter scenario is about balancing accessibility, security, and limited resources in a temporary deployment using automated detection, and the submarine scenario is about military-grade security with complete physical air-gapping and clearance-based access.
The common thread across all three: defense in depth through multiple layers, segmentation isolating different security zones, controls matched to the actual threat level and context, detective controls providing real visibility, and a constant balance between security needs and practical operational requirements. Good network security always comes down to understanding both the technical controls available and the real-world context they're being applied in.