[Autogenerated] Jacob In the theory section,
I talked about scope reduction and how to segment your network into smaller
networks on how to do other techniques such as token ization,
orcs on cryptography or outsourcing to reduce the scope
of PC ideas s in an organization.
There's a QS.
I'm sure you've seen lots of organizations do scope reduction to
reduce the scope and complexity of PC OD assessed.
Yes, Could you give me a flavor of what's good and what's bad?
Sure.
So the good examples, right?
Maybe our cases where you can sort of clearly outsource some functionality
or or sort of airlift that that component out of your organization and get
somebody else toe to sort of do it right.
And then the components, the networking pieces,
the systems, the people,
the processes that you used to have in your environment are now.
Somebody else is right,
and all you're doing is kind of managing that business relationship.
Those air, usually pretty successful.
There are success cases where somebody has
implemented some network segmentation.
Thes two networks used to be commingle.
They used to be one, and they have sort firmly divided them,
right, the where your packets don't get for one to the other,
right?
Good, well and good.
And sometimes you have to then build some other network,
you know, some other infrastructure pieces to service.
Now both sides of that divide right and and very
often that sort of worth the effort.
So you might have.
You might split yourself into two domains friends on Exactly right.
That's there's one very common case where that sort of thing happens.
I've seen this go badly also where,
and organizations that it fails to understand what segmentation really is on.
And they don't really engage us as the assessor early on in the process, right?
And there's so many cases where I tell my clients,
I wish we could have done this.
I wish we could have had this conversation four months ago, right?
Right,
And then we could have at least sort of steered you in a better direction
because they sort of burrow themselves underground and ______ away at at
working on their networking devices on their segmentation,
and they come back up and they say, Look,
these air now totally separate,
except for these 18 ports and services that we
allow between the two environments.
And I say That's not segmentation, right?
And that's not what you want to hear after you've committed so
much time and energy and exercise like that.
So again, that's get your que essa early.
If you're going to try and do scope reduction by segmentation to
make sure that it's actually proper segment,
right, right and then be prepared to put together a meaningful strategy.
I mean,
this is true of just about any major engineering effort that
you're going to do in your compliance effort.
Put together a useful project plan.
Put together a useful description of what you would tend to do,
right,
your assessor review it and critique it right and then commit to that effort.