OT/IT Segmentation at Titan Manufacturing
Titan Manufacturing has 12 plants with a flat IT and OT network. A ransomware infection on a corporate laptop spread to a plant HMI and halted production for 36 hours. The environment has 4,000 IT devices and 600 OT devices, including PLCs, HMIs, and historians. The only firewall between IT and OT allows any/any. Vendor technicians connect over VPN using shared accounts to troubleshoot equipment. The board has approved a 9-month segmentation roadmap with a $1.2M budget. Engineering leaders fear that segmentation will break real-time production traffic and are resisting firewall changes. The CISO needs to show measurable risk reduction within the first 90 days while building toward a defensible zone architecture. There is no OT asset inventory, and 40% of OT devices run unsupported operating systems.
1. Propose a segmentation zone model and enforcement points for Titan's IT and OT environments.
Read the worked answer
Propose a Purdue-inspired zone model with explicit conduits and enforcement at IT/OT boundaries and intra-plant cell zones.
- Zones: Enterprise IT (corporate), DMZ (remote access/jump hosts), plant IT (historian, MES), supervisory OT (SCADA/HMI), control OT (PLCs/RTUs), and safety systems. Each plant gets its own OT zone to prevent cross-plant spread.
- Enforcement points: Next-generation firewalls between IT and plant IT; industrial firewalls or ACLs between supervisory and control zones; host-based firewalls on HMI/engineering workstations; network taps/IDS for OT protocols (Modbus, DNP3).
- Conduits: Allow only required protocols and destinations (e.g., historian to MES on port 1433; no direct PLC to internet). Use a jump host in the DMZ for vendor access.
- No any/any: Replace the single IT-OT firewall rule set with deny-by-default and documented flows.
Reasoning: The ransomware spread because there was no boundary. Zones limit blast radius; conduits keep production traffic flowing.
2. How should Titan prioritize the segmentation work with a $1.2M budget and a 9-month deadline?
Read the worked answer
Phase by risk: stop the bleeding first, then structural segmentation.
- Phase 1 (0-90 days, ~$300k): Replace the any/any IT-OT firewall rules with deny-by-default; deploy a jump host and MFA for vendor access; segment the 12 plants from each other at the WAN edge. These are low-cost, high-impact.
- Phase 2 (3-6 months, ~$500k): Deploy industrial firewalls at the supervisory/control boundary in the 4 highest-risk plants (largest revenue or most exposed). Add OT network monitoring.
- Phase 3 (6-9 months, ~$400k): Extend to remaining plants; implement microsegmentation on HMI/engineering workstations.
- Trade-off: Full microsegmentation in all 12 plants would exceed $1.2M. Prioritize by revenue impact and known vulnerabilities. Use existing switch ACLs where possible.
Reasoning: Budget cannot buy perfect segmentation in 9 months. The biggest risk reduction per dollar is removing any/any and isolating plants, not buying new tools.
3. How should Titan replace shared vendor VPN accounts and reduce third-party remote access risk?
Read the worked answer
Replace shared VPN accounts with brokered, session-recorded, just-in-time access.
- Identity: Each vendor technician gets a named account federated to their employer or a sponsored identity, with MFA. No shared credentials.
- Access path: Vendor connects to a DMZ jump host, not directly to the OT network. The jump host brokers RDP/SSH to specific assets based on a ticket/approval. Session recording and keystroke logging are mandatory.
- Least privilege: Grant access only to the assets needed for the work order, for a defined window (e.g., 4 hours). Auto-expire after the window.
- Monitoring: Alert on after-hours access, new asset targets, and file transfers. Integrate with the SIEM.
Reasoning: Shared VPN accounts make attribution impossible and let one compromised vendor credential move laterally. Brokered access with recording gives accountability and limits blast radius.