Flat OT Network After Ransomware
A water utility's treatment plant has a flat /16 OT network with 120 PLCs, 18 HMIs, 35 Windows XP and 7 engineering workstations, and a shared Active Directory domain with corporate IT. The plant has no IDS, and vendor support connects through shared TeamViewer credentials. A ransomware event encrypted 6 HMIs and a historian; production stopped for 4 hours. Backups exist on a NAS that was also encrypted. The utility cannot patch PLCs, has no OT staff at night, and must keep the plant running during any change. Corporate IT wants to apply the same EDR and Group Policy to OT. The board asks for a zero-trust-aligned plan, not a product list.
1. Prioritize the first 30 days of segmentation and compensating controls. Explain the sequencing against the plant's availability constraints.
Read the worked answer
Sequence by containment value and reversibility, not by tool deployment:
- Inventory conduits and remote access first. Identify every path between IT and OT, vendor connections, and shared TeamViewer accounts. Disable shared credentials and replace them with named accounts, MFA, and a jump host in an OT DMZ. This is the highest-value change because the ransomware likely used a shared path.
- Create an OT DMZ and deny direct IT-to-OT traffic. Allow only required protocols through a firewall or industrial security appliance, with rules based on source, destination, and service. Do not attempt full microsegmentation of 120 PLCs in 30 days.
- Protect the HMIs and engineering workstations. These are Windows assets and can take EDR, application allowlisting, and restrictive Group Policy. Do not put agents on PLCs. Isolate XP/7 systems on a dedicated VLAN with strict ACLs and no internet access.
- Fix backups. Move one copy offline or to immutable storage, test restoration, and remove the backup NAS from the same domain and network segment.
- Add passive OT monitoring. Span a mirror port to an OT IDS to baseline PLC traffic before enforcing new rules.
Each change must have a rollback and a plant-operator window. Keep the plant running by enforcing at the DMZ first, not by touching PLCs.
2. How would you apply zero trust principles to this legacy OT environment without breaking production? Be specific about what zero trust does and does not mean here.
Read the worked answer
Zero trust here means explicit verification of users, devices, and flows around the OT assets, not installing identity agents on PLCs:
- Identity for people and remote vendors: named accounts, MFA, just-in-time access, session recording, and approval workflows. Shared TeamViewer credentials violate least privilege and make attribution impossible.
- Device trust for IT-capable endpoints: HMIs and engineering workstations get EDR, patching where supported, and allowlisting. PLCs get network-based trust through fixed conduits and protocol-aware filtering, because they cannot run agents.
- Microsegmentation by conduit, not by every device: define zones such as safety, process control, historian, and DMZ. Permit only required flows, for example HMI-to-PLC and historian-to-PLC, and deny east-west traffic by default at the zone boundary.
- Assume breach: deploy passive monitoring, log firewall denies, and test whether an infected HMI can reach the historian or corporate IT. Keep offline backups and a tested manual operating procedure.
Do not promise that zero trust eliminates the need for OT patching or network segmentation. It changes the enforcement point from a flat perimeter to controlled conduits and verified access. Measure success by reduced reachability, not by product coverage.