Network segmentation for a private bank

The network was entirely flat: any infected staff machine could reach the core system servers. The annual security audit flagged this as a critical risk to be resolved before renewal.

We designed a VLAN segmentation separating the core systems environment from the staff and guest networks, and deployed two FortiGate firewalls in an HA pair with explicit traffic policies between segments.

The cutover was carried out in stages over weekends to avoid any downtime during business hours.

The internal attack surface was reduced substantially, and the bank passed its next security audit with no critical findings. For the first time, the IT team had clear visibility of traffic moving between segments.