I85PREP
⌘ K
CWSR study materials
CWSR study resources

Contractor BYOD Access to an Internal Inventory Application

CWSR · Put your knowledge to work in context.

All case studies

Contractor BYOD Access to an Internal Inventory Application

A manufacturing plant has 200 contractors per day who need to access a single internal inventory web application at 10.10.5.20:8443 and the internet. Contractors use their own laptops and phones. The plant has no Active Directory accounts for contractors, and the IT team does not want to issue corporate credentials. The existing guest network is an open SSID with a captive portal that only requires an email address; it is flat and allows access to the internal inventory application by IP address because a previous contractor complained. Security recently found a contractor laptop scanning the internal /16 network. The plant is subject to IEC 62443 and must segment operational technology (OT) from IT. The CISO wants a design that provides contractor access without allowing lateral movement, while keeping onboarding simple for non-employees.

1. Design a contractor onboarding and guest network flow that provides access to the inventory application without corporate credentials.

Read the worked answer

The design must replace the open SSID and direct IP access with a sponsored, time-limited, role-based flow.

Onboarding flow:

  1. The contractor connects to an isolated registration SSID that has no internal routing.
  2. The captive portal asks for the contractor’s name, company, host name, and a sponsor from the plant. The sponsor approves by email or SMS.
  3. The portal issues a one-time code or uses a guest identity provider to authenticate the contractor. No corporate AD account is created.
  4. After approval, the contractor receives a WPA2-Enterprise or WPA3-Personal credential-preferably a short-lived per-device PSK or an EAP-TTLS credential with a one-time password-and a device registration. The credential expires at the end of the visit or after 24 hours.
  5. The device is placed in a contractor VLAN with client isolation.

Application access: Do not allow direct access to 10.10.5.20:8443 from the guest VLAN. Publish the inventory application through a reverse proxy or application gateway in a DMZ. The proxy authenticates the contractor with a separate application account or a signed URL issued by the sponsor, then forwards only the required HTTP traffic to 10.10.5.20:8443. This removes the need for corporate credentials on the WLAN and prevents the contractor from reaching the application by IP scanning.

Why this is simpler for non-employees: The sponsor handles authorization, the contractor does not need an AD account, and the credential is temporary. The trade-off is sponsor workload, so automate approval for repeat contractors and audit sponsor responses.

2. Specify segmentation and access-control rules that prevent lateral movement from the contractor network to IT and OT networks.

Read the worked answer

Segmentation must be enforced by a firewall, not by VLANs alone, because a flat guest VLAN is what allowed the /16 scan.

VLAN and zone design:

  • Contractor VLAN: internet-only plus reverse-proxy access.
  • Employee IT VLAN: corporate resources.
  • OT VLAN: manufacturing control systems, separated from IT per IEC 62443 zones and conduits.
  • DMZ: reverse proxy and application gateway.

Firewall rules:

  • Contractor VLAN to internet: allow HTTP/HTTPS and DNS only; deny all other outbound ports.
  • Contractor VLAN to DMZ reverse proxy: allow TCP 443 only, with the proxy authenticating the user and forwarding to the inventory app.
  • Contractor VLAN to IT and OT: deny all. Do not create an exception for 10.10.5.20:8443 from the contractor VLAN; the proxy is the only path.
  • Contractor VLAN to contractor VLAN: deny or enforce client isolation, because peer-to-peer scanning and malware spread are risks.
  • OT to internet: deny except through approved conduits; OT to IT: restrict to specific management and historian flows.

NAC enforcement: Assign the contractor VLAN dynamically after sponsor approval and device registration. If a contractor device spoofs a MAC or tries to join the employee SSID, NAC should reject it. Use private VLAN or client isolation on the contractor SSID to block lateral scanning.

Why this satisfies IEC 62443: The OT network is in a separate zone with a defined conduit, and the contractor zone has no direct route to OT. The reverse proxy is the only conduit to the inventory app, and it can log and inspect requests.

3. Recommend monitoring and policy controls to satisfy IEC 62443 expectations and detect misuse.

Read the worked answer

IEC 62443 expects defense in depth, least privilege, and monitoring of zone boundaries. The controls should focus on the contractor-to-DMZ conduit and the contractor VLAN.

Monitoring:

  • Log all firewall denies from the contractor VLAN to IT and OT, and alert on scans, repeated connection attempts, and unusual destination ports.
  • Capture NetFlow or IPFIX from the contractor VLAN and baseline normal behavior: DNS, HTTP/HTTPS, and the reverse proxy. Alert on SMB, RDP, SSH, SNMP, or industrial protocols from contractor devices.
  • Monitor the reverse proxy for authentication failures, parameter tampering, and access to paths outside the inventory application.
  • Use the WIPS to detect rogue APs, evil twins, and deauth floods on the contractor SSID.

Policy controls:

  • Require sponsor approval and a defined visit duration; expire credentials automatically.
  • Prohibit contractor devices from bridging to other networks; detect and block ICS/OT protocol traffic from the contractor VLAN.
  • Publish an acceptable-use policy at onboarding: no scanning, no peer-to-peer, no storing plant data on unmanaged devices.
  • Review contractor access logs weekly and sponsor approvals monthly. Retain logs according to legal and IEC 62443 audit requirements.
  • Test the segmentation quarterly with an authorized internal scan from the contractor VLAN; the expected result is that only the reverse proxy and internet are reachable.

Incident response: If a contractor device scans the internal /16 again, the NAC should quarantine the device, revoke its credential, notify the sponsor, and preserve firewall and proxy logs. This turns the previous finding into a detectable and enforceable policy violation rather than an open door.