Flat Network, One Segmentation Window
A 600-employee manufacturer runs a single /16 flat network. OT controllers on the plant floor share the same VLAN as corporate laptops because 'it was easier in 2019.' A recent pen test found that a compromised marketing laptop could reach the PLC programming workstation in three hops. Leadership approved a segmentation project but capped the change window at one Saturday night (8 hours) and refused to fund new hardware - only existing L3 switches and a firewall with 4 free interfaces are available. The plant runs 24/7 except for a scheduled maintenance shutdown in six weeks. The CISO wants 'the biggest risk reduction we can buy in one window' and asks you to pick the first cut.
1. Which segmentation cut do you make first, and why that one over the other candidates?
Read the worked answer
First cut: isolate the OT/plant-floor zone from corporate, using the firewall's free interfaces and an existing L3 switch as the OT gateway.
Reasoning:
- Highest consequence, lowest blast radius to change. The pen-test finding - marketing laptop to PLC programmer in three hops - is the exact path that converts a commodity phish into a physical safety/availability event. Cutting it removes the worst outcome, not just a bad one.
- It fits 8 hours. Moving the OT subnet behind an L3 gateway and a firewall interface is a routing/VLAN change, not a re-cabling project. Corporate-side changes are minimal.
- It fits the shutdown dependency. OT changes that could interrupt a running line should be validated in the six-week maintenance window; the routing cut can be staged now and the enforcement tightened at shutdown. Do the cut in two phases: build the path Saturday, flip default-deny at the maintenance window.
Candidates rejected for the first cut:
- User-to-user micro-segmentation - high effort, low marginal risk reduction vs. the OT path.
- Server-farm segmentation - worthwhile, but the pen-test path didn't run through it.
Policy for the new boundary: default-deny, allow only named flows (historian pull, patch/AV relay, jump-host RDP for engineers), logged. No 'allow any from corporate' rule - that recreates the flat network on a firewall.
2. Leadership asks how you will prove the cut worked and what you will tell them if the plant has an outage on Saturday.
Read the worked answer
Proof of effect (before/after):
- Re-run the specific pen-test path from the marketing VLAN to the PLC programmer; document that it now fails at the firewall with a logged deny.
- Pull firewall logs showing the deny, plus the allow-list flows still passing (historian, patch relay) so we can show we didn't just break everything.
- A short table: flow, old result, new result, owner.
Outage communication plan:
- Pre-agree a rollback trigger and owner before Saturday: if a critical flow (historian, MES, patch) is down >15 min and the cause is the new boundary, the on-call network lead reverts the specific rule - not the whole project - and we re-stage.
- Pre-brief plant ops and the on-call engineer with the exact allow-list and a one-page 'if X is down, check rule Y' guide.
- Tell leadership up front: some flow will likely be missed; the design goal is fast, surgical rollback, not zero surprises. A Saturday outage that is reverted in 15 minutes is a successful change window; a silent week-long broken historian is the real failure.
Honesty point: if we cannot get the historian and patch flows confirmed in writing by Friday, we should defer the default-deny flip to the maintenance window rather than gamble on a live line.