IoT Device on Corporate VLAN
A non-corporate or IoT device, such as the Summit Ridge showroom TV, was moved onto the corporate VLAN through a switch configuration change on sr-acc02 port Gi1/0/14.
- Trigger
- Configuration diff or device classification shows a device without corporate management (no domain join, no EDR) attached to a VLAN designated for corporate assets.
- Risk
- A poorly segmented IoT device widens the blast radius of any compromise, since it can be used to pivot toward corporate systems on the same broadcast domain. This is a segmentation control failure independent of the device's own vulnerability profile.
Prerequisites
- Confirm the device's actual function and required network access
- Identify or create the correct IoT/guest VLAN for the device class
- Confirm switch access to sr-acc02 and the specific port configuration
Recommended fix
- Confirm the device classification and its lack of corporate management (EDR, domain join).
- Identify or provision the correct segmented VLAN for this device class.
- Change the port configuration on sr-acc02 Gi1/0/14 to the correct VLAN.
- Verify the device regains required connectivity (e.g., internet access for a smart TV) on the new VLAN.
- Confirm inter-VLAN firewall rules prevent the segment from reaching corporate systems.
- Re-run discovery to confirm the device now reports on the correct segment.
Validation
- Network Map shows the device on the correct IoT/guest VLAN
- Segmentation check confirms no route from the IoT VLAN to corporate subnets
- The device continues to function as expected on its new VLAN
Rollback and recovery
- If the device loses required functionality, verify VLAN DHCP scope and firewall rules before reverting; revert the port to the previous VLAN only as a temporary measure while re-diagnosing.
Evidence generated
- Before/after switch port configuration record for sr-acc02 Gi1/0/14
- Updated VLAN and segmentation evidence from discovery
- Change record marked as authorized