Open cardosec

Case F748C1 · Network · L3 Applied

Ransomware Crossed the Flat Network

Practise as: Incident drill · InterviewLevel: L3 Applied

Live alertRansomware encrypted 400 servers in 40 minutes. The attacker reached every server from one compromised desktop over SMB and RDP, using a local admin password shared across all machines. Recovery is under way; the board asks what has to change in the architecture.

Interview questionAfter a ransomware outbreak spread across a flat network, the board asks you for architecture changes. What do you propose?

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Name the root causes: no internal segmentation and one shared local admin password, so one foothold reached everything.
  2. Segment east-west: desktops cannot reach server admin ports; admin access only from hardened jump hosts or PAWs.
  3. Unique local admin passwords (Windows LAPS) and AD tiering, so credentials from one tier never work in another.
  4. Make recovery survivable: immutable or offline backups, tested restores, and EDR on every server.
  5. Sequence it: quick wins in weeks (LAPS, blocking SMB and RDP from desktops), then the longer segmentation program.

If the interviewer pushes back

  • The business says segmentation will break a legacy app nobody understands. What do you do?

Go deeper

More Network cards

All Network cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09