Historian Bridge Under Pressure
Northline Water Alliance runs 14 drinking-water treatment sites. Its corporate IT network and OT network are separated by a firewall, but a historian server is dual-homed: one NIC in IT, one in the OT distribution VLAN. The firewall permits SMB 445 and SQL 1433 from IT to the historian and from the historian to three PLC subnets so that maintenance staff can pull reports. Last week the IT SOC confirmed ransomware on two corporate file servers. The same night, the OT passive sensor recorded SMB tree-connect attempts from the historian toward PLC subnets, plus ARP scans. Plant processes remained stable. The utility cannot take the historian offline during the next six weeks because regulatory reporting depends on it. A one-way data diode was proposed last year but capital funding was deferred. The OT manager wants a fix that preserves reporting and does not rely on user training.
1. What containment actions should be taken in the next 24 hours, and how would you preserve reporting?
Read the worked answer
Start from the assumption that the historian is now an IT-to-OT bridge. The 24-hour goal is to break that path without stopping treatment.
- Remove the historian's ability to route or forward traffic between NICs. Disable IP forwarding and apply host firewall rules that permit only the specific historian-to-PLC collection protocols and the IT-to-historian reporting query, not SMB 445 in either direction.
- Block SMB from IT to OT at the firewall and from the historian to PLC subnets. Keep SQL 1433 only from the specific reporting subnet to the historian, not from the historian into OT.
- Isolate the historian's IT-facing NIC to a dedicated reporting VLAN, and restrict inbound access to the reporting server and named administrators.
- Preserve reporting by having the historian continue to collect from PLCs on its OT NIC while IT reads replicated data from a separate reporting database or file export on the IT side.
- Capture volatile evidence first: ARP cache, SMB session logs, firewall logs, and a memory image if policy allows. Reimage the historian if compromise is suspected.
Do not rely on blocking 445 alone; the historian still has two live paths. Verify with packet captures that no SMB or ARP crosses the bridge after the change.
2. Design the target architecture to bridge the air gap, given that a data diode is not funded this year.
Read the worked answer
The target design should enforce one-way data flow from OT to IT and eliminate dual-homed servers.
- Place a dedicated historian or replication service inside the OT zone. It collects from PLCs and stores the authoritative OT data.
- Export only the required reporting data to an IT-facing server through a controlled one-way path. With no diode, the interim option is an application proxy or data-transfer service that accepts no inbound connections from IT and exposes no SMB, RDP, or routing into OT.
- Put the IT-facing replication endpoint in a DMZ, not in the corporate LAN and not in the OT VLAN. Allow IT to query only that endpoint over a single application port.
- Use allowlisted source and destination pairs, host firewalls, and logging on both sides. Disable all unused services on the historian.
- Treat the proxy as a compensating control, not a true diode. Its residual risk is bidirectional reachability at the TCP/IP layer, so document that limitation and keep the diode in the capital plan.
The key judgment is that the current dual-homed historian is a router in practice. The redesign must remove that dual-homed role, not just add more firewall rules around it.
3. Why is simply adding a firewall rule to block SMB 445 between IT and OT insufficient here?
Read the worked answer
It is insufficient because the historian is dual-homed. A firewall rule between IT and OT may never see traffic that enters the historian on the IT NIC and leaves through the OT NIC, especially if the host forwards or if the rule is applied only at the perimeter.
Also, SMB is not the only path. The historian has SQL 1433 and OT collection protocols, and an attacker on the historian can use those allowed channels or ARP to discover and reach PLCs. Blocking one port leaves a live host with two network identities and an implicit routing capability between zones.
The correct judgment is to fix the host and the architecture: disable forwarding, remove the dual-homed configuration, restrict the host firewall, and separate the IT-facing reporting function from the OT collection function. Port blocking is useful as a backstop, but it does not remove the bridge.