Compensating Controls for Legacy OT on the Shop Floor
You are security director at a specialty chemicals manufacturer with 4,000 IT endpoints and 120 OT devices across two plants. A recent penetration test gained initial access through a phishing email, moved laterally to a domain controller, and from there reached an OT historian because the shop-floor network shares a flat Layer 2 with corporate IT. The OT devices run Windows Server 2012 R2 and Windows 7. The vendor will not support EDR agents and says upgrades require plant shutdowns costing $480k per week. Capital budget is $250k this year. The COO wants the OT environment isolated immediately, but plant engineering says production cannot stop. You have 14 weeks before the next board meeting. Options discussed include network segmentation, virtual patching, application allowlisting, and replacing the oldest 30 devices. The CISO asks for a control strategy that reduces lateral movement risk without promising a shutdown.
1. Recommend a sequence of compensating controls and justify why segmentation is or is not first.
Read the worked answer
Segmentation should be first because the penetration test showed a direct attack path from corporate IT through a domain controller to the OT historian. However, the goal should be phased segmentation through an industrial DMZ and firewall rules, not an immediate full air gap. Full isolation may break data flows and production, while phased segmentation can be implemented during maintenance windows with rollback plans.
Sequence:
- Segment IT from OT using an industrial DMZ and allow only required conduits. This breaks the flat Layer 2 path and reduces lateral movement likelihood more than any endpoint control.
- Deploy application allowlisting on OT endpoints that can support it. This blocks unauthorized execution and helps compensate for unsupported operating systems.
- Apply virtual patching through network controls and compensating signatures for known vulnerabilities.
- Replace the oldest 30 devices in a capital plan, prioritizing those that cannot be segmented or allowlisted.
The trade-off is cost and availability. The $250k budget cannot do everything. Segmentation and allowlisting may be achievable with existing firewalls and software, while device replacement consumes most of the budget. Do not promise zero downtime; present a pilot line and maintenance-window plan.
2. How would you measure control effectiveness and report residual risk to the board?
Read the worked answer
Measure control effectiveness with metrics tied to the attack path, not raw vulnerability counts:
- Number of attempted IT-to-OT connections blocked and number of allowed conduits reviewed.
- Percentage of OT assets covered by monitoring and allowlisting.
- Mean time to apply virtual patches for known exploitable vulnerabilities.
- Number of allowlist blocks and unauthorized execution attempts.
- Penetration test retest results showing whether lateral movement is blocked.
- Production availability during segmentation changes.
Report residual risk as changes in likelihood and impact. For example, segmentation reduces likelihood of IT-to-OT lateral movement; allowlisting reduces likelihood of malware execution; virtual patching reduces impact of exploitation. Avoid presenting only counts of blocked events, because they do not show risk reduction. Use a control effectiveness score and state assumptions. If a control is not yet operating, keep residual risk at the higher level rather than claiming improvement. Give the board a simple table: control, coverage, evidence, residual risk trend, and next decision.
3. What would you do if engineering refuses segmentation during production hours?
Read the worked answer
Escalate through governance rather than bypassing engineering. Document the risk, the requested control, and the refusal. Present options to the COO and risk committee: a pilot on a non-critical line, passive network monitoring first, or firewall rules that can be applied without production downtime. If segmentation cannot be done during production, schedule it during a planned maintenance window with a rollback plan.
If engineering still refuses, request a formal risk acceptance from the COO or business owner, with a defined expiration date and compensating controls such as enhanced monitoring and restricted conduits. The CISO should not silently accept the risk. Also engage plant safety and quality leaders, because OT changes can affect safety and product quality. The key is to keep the decision visible, time-bound, and owned by the business, while continuing to reduce risk through controls that do not require a shutdown.