Four-Hour Patch Window on a Packaging Line
Meridian Pharma runs a packaging line with three Windows 7 HMIs, two PLCs, and one OPC UA gateway. A quarterly scan found: (A) CVSS 9.8 unauthenticated remote code execution in the OPC UA service on all three HMIs, reachable from the flat OT LAN and from a vendor VPN that terminates on the same VLAN; (B) CVSS 8.1 PLC firmware flaw requiring a project file upload, with no public exploit; (C) missing Windows 7 patches from 2020, including SMBv1; (D) low-risk SNMP community string 'public' on a switch. The next shutdown is four hours long, then none for eleven weeks. The vendor will not support the line if HMI software is upgraded outside a qualified service visit, which takes two days and cannot fit the shutdown. Production refuses any change that could stop the line.
1. Rank the four findings for action and justify the ranking using exploitability, exposure, and operational risk.
Read the worked answer
A should be first. It is unauthenticated remote code execution, reachable from the flat OT LAN and from a vendor VPN on the same VLAN. The combination of high impact, network exposure, and a likely available exploit outweighs the other findings. The vendor support constraint affects the remediation method, not the priority.
C should be second. Missing Windows 7 patches plus SMBv1 create lateral-movement and worm risk, and SMB is commonly targeted. However, it is a broad patch set with higher operational risk than a targeted service restriction.
B should be third. The PLC firmware flaw requires a project file upload and has no public exploit, so it needs a trusted insider or a compromised engineering workstation. It is serious but less immediately exposed than A.
D should be last. The SNMP community string is low impact on a switch, but it is still a quick, low-risk fix and should not be ignored. The ranking reflects risk, not the CVSS score alone: A has the best combination of exposure and exploitability.
2. What can safely be done in the four-hour shutdown, and what compensating controls should cover the eleven weeks?
Read the worked answer
In four hours, avoid an unsupported HMI software upgrade. Instead, reduce exposure and collect evidence.
- Restrict OPC UA on each HMI with host firewall rules so only the OPC UA gateway and the engineering workstation can reach the service. If the vendor permits, disable OPC UA on HMIs that do not need to serve it.
- Move the vendor VPN termination off the OT VLAN or block it from reaching HMIs directly. Require vendor access through a jump host with logging and approval.
- Disable SMBv1 only after confirming no application depends on it; if that cannot be verified in four hours, block SMB at zone boundaries and schedule the change.
- Change the SNMP community string and restrict SNMP to the management station.
For eleven weeks, add application allowlisting on HMIs, restrict removable media, monitor OPC UA and SMB traffic, and require change tickets for vendor sessions. Schedule the qualified two-day vendor visit for the HMI and PLC fixes. Document the residual risk and the exact conditions under which the line would be stopped.
3. How should the team document a risk exception for the unfixed HMI vulnerability?
Read the worked answer
The exception should be specific and time-bound, not a generic acceptance. Record the asset names and IP addresses, the vulnerability and affected service, the exposure path from the OT LAN and vendor VPN, and why the supported fix cannot be applied before the vendor visit.
Then state the compensating controls actually in place: host firewall allowlists, VPN termination change, jump-host logging, monitoring rules, and restricted engineering access. Include the residual risk in business terms, for example the possibility of unauthorized code execution on an HMI leading to line stoppage or product quality impact.
Assign an owner, an expiry date, and a trigger for re-review, such as a new exploit, a failed control test, or the vendor visit date. Require evidence that controls were tested, not just configured. The judgment is that an exception is a managed decision with a deadline and compensating controls; it is not a permanent waiver because production refuses downtime.