Campus Network Segmentation and Safeguarding Controls
Educational institutions manage open campus networks alongside sensitive research data, student safeguarding records, and financial systems. The culture of openness that enables learning also creates significant cybersecurity challenges.
Key threats addressed
Education
When a student's personal device and the school's safeguarding database share the same network, every compromised student laptop is a potential path to the most sensitive data an institution holds.
100%
Safeguarding data isolation from campus networks
Zero
Direct paths between research and admin systems
4
Campus zones with independent governance
Full
DfE and Ofsted safeguarding evidence
Educational networks balance openness with protection.
Safeguarding Data Risks
Student safeguarding records, SEN data, and child protection information must be rigorously protected while remaining accessible to authorised pastoral staff.
Open Campus Networks
Universities and schools operate open networks for learning that also connect to sensitive administrative, financial, and research systems.
Research Data Theft
University research data, particularly in defence, pharmaceutical, and technology sectors, is targeted by nation-state actors for intellectual property theft.
The Scenario
Scenario: University Ransomware and Research Data Theft
Ransomware enters through a compromised student laptop on the campus Wi-Fi network. It propagates across the flat campus network, reaching administrative systems, research servers, and the student records database. The university loses access to exam results during clearing week, research data for three funded projects is encrypted, and safeguarding records for vulnerable students are exposed. With Control, the campus network is physically separated into student, research, administrative, and safeguarding zones. The ransomware cannot propagate beyond the student zone because the network paths to other zones do not exist.
"The ransomware came in through a first-year student's laptop. Twelve hours later, it had encrypted our research servers, our student records, and our finance system. We lost three years of PhD research data because the backups were on the same network."
Where each Control module is deployed across staff, students, research and suppliers.
Education networks carry staff, students, research and a long tail of suppliers. Control puts a real boundary at the places that matter, in line with the JISC reference architecture.
Grounded in the JISC reference architecture and NCSC guidance for HE / FE / schools.
Internet / Janet
External
Firebreak
ValidateExternal traffic stops at the perimeter.
Perimeter
DMZ · trust boundary
IsolateValidateIdentity sits behind its own boundary.
Identity
IT
LockSystem access ties to named users.
Staff and student systems
IT
Isolate
TransferLockResearch data moves on a controlled, named route.
Research
Data
Sensitive research is a separate fabric.
Sensitive research is a separate fabric.
Crown jewels
Off-network
Detail callout · A
Offline Secure Storage
Research datasets, exam records, statutory archives and any data you must keep recoverable.
Offline by design · secure by defaultModules & symbols
FirebreakPhysical severValidateIntegrity checkIsolateZone boundaryLockNamed accessTransferControlled moveWhere each module is deployed, and what it does there.
One row per module. Placement on the network, then plain-English purpose at that point.
-
Firebreak
On the E0 to E1 link
A real hardware off switch on the perimeter, ready to drop the live path between the public estate and operations.
-
Validate
On the E0 to E1 link and the E1 to E2 link
Inbound traffic and identity requests are checked for origin and authority before they progress.
-
Isolate
On the E1 to E2 link and the E3 to E4 link
Identity and research sit on their own physical fabrics. A compromise on the staff or student side does not walk into sensitive research.
-
Lock
On the E2 to E3 link and the E3 to E4 link
Access ties to named users with the right entitlement.
-
Transfer
On the E3 to E4 link
When data feeds research, Transfer governs the route, the de-identification and the landing point.
Featured In
Key Capabilities
Data Sovereignty
All safeguarding and student data remains within the agreed jurisdiction in secured Firevault Bunkers, meeting DfE data handling requirements.
Safeguarding Access Controls
Access to safeguarding records requires authorisation from designated safeguarding leads with full audit logging.
DfE and Ofsted Evidence
Automated compliance logging supports DfE cyber security standards, Ofsted safeguarding requirements, and GDPR obligations.
Campus Cellular Management
Out-of-band management via cellular connectivity ensures governance capability independent of the campus network.
Safeguarding Audit Trail
Every access to safeguarding data is recorded in tamper-proof logs for regulatory inspection and child protection reviews.
Research Data Recovery
Verified baselines of research-system configuration enable restoration of funded project work regardless of campus network compromise.
Demo to Live
Adoption Guide
Campus Network Assessment
Map all network paths between student access, research systems, administrative infrastructure, and safeguarding data to identify segmentation gaps.
Campus Zone Design
Design physically separated zones for student access, research, administration, and safeguarding with Control modules at each boundary.
Department Pilot
Deploy in a representative faculty or department with full zone separation, safeguarding data governance, and compliance logging.
Institution-Wide Deployment
Full deployment across the campus with verified configuration baselines, continuous compliance evidence, and cellular management capability.
Campus Network Assessment
Map all network paths between student access, research systems, administrative infrastructure, and safeguarding data to identify segmentation gaps.
Campus Zone Design
Design physically separated zones for student access, research, administration, and safeguarding with Control modules at each boundary.
Department Pilot
Deploy in a representative faculty or department with full zone separation, safeguarding data governance, and compliance logging.
Institution-Wide Deployment
Full deployment across the campus with verified configuration baselines, continuous compliance evidence, and cellular management capability.
Relevant Control Blueprints
Deployment patterns that apply here
Stop Kill-Chain Ransomware
Stop ransomware moving, spreading or reaching the crown jewels.
View blueprintControl Third-Party Access
Give third parties access without giving them a permanent doorway.
View blueprintProve Compliance Through Control
Compliance becomes stronger when control can be demonstrated, not just documented.
View blueprintQuestions
Frequently Asked
Speak to the team to organise a PoC
Walk through your blueprint with the Firevault team and scope a proof of concept on your estate. 30 minutes, no sales pitch.