Inline IPS on a Batch Mixing Line
GreenField Foods has a batch mixing line with six PLCs, two HMIs, and a batch controller on one OT VLAN. A passive IDS mirrors the core switch and produces about 300 alerts per day; the OT engineer estimates only 12 are true security events. The plant manager wants to buy an inline IPS that automatically blocks Modbus/TCP writes to PLC coils when the IDS sees an unauthorized source. The line runs 20 batches per day; a blocked write could spoil a batch worth USD 40,000. The safety instrumented system is on a separate VLAN but shares the same physical switch. The vendor's IPS supports Modbus/TCP deep packet inspection but has no certified OT bypass; its fail-open mode takes 8 seconds to activate. The site has no 24x7 monitoring and relies on the day-shift electrician to check alerts.
1. Should the plant deploy the inline IPS with automatic blocking now? Justify your answer.
Read the worked answer
No, not as proposed. The IPS is being asked to make real-time blocking decisions on a process network with no 24x7 monitoring and a high cost of false positives. The IDS is already producing about 300 alerts per day with only about 12 estimated true events, so the detection logic is not tuned enough to trust automatic Modbus write blocking.
The lack of a certified OT bypass is also decisive. An 8-second fail-open transition can interrupt communications to PLCs and batch controller, and the line values one spoiled batch at USD 40,000. The safety system is on a separate VLAN, but it shares the physical switch, so an inline device or switch change near that path needs a safety review.
The better judgment is to keep passive monitoring first, tune detections, and build a tested bypass before any inline deployment. If inline is later justified, start in monitor-only mode, then enforce only narrow, well-understood rules with an external bypass and a rollback procedure.
2. How should the IDS/IPS be placed and tuned to reduce the 300 alerts per day?
Read the worked answer
Place passive monitoring at the OT zone boundary and at the core switch mirror, with separate capture for the PLC/HMI VLAN and any vendor access path. Do not mirror the safety VLAN into the same sensor without a safety review. If inline is tested later, place it between the batch controller and PLCs only after confirming that the safety system path is physically and logically separate.
Tuning should start with asset baselines. Build an inventory of legitimate Modbus masters and slaves, allowed function codes, coil and register ranges, and normal batch schedules. Suppress alerts for known engineering workstation maintenance windows and approved vendor sessions. Replace broad signatures with protocol-aware rules that alert on unauthorized write sources, out-of-schedule writes, and writes to safety-related or non-process coils.
Review the remaining alerts daily for two weeks, classify them, and measure precision. The goal is not zero alerts; it is a small set of actionable alerts that the day-shift electrician can triage. Automatic blocking should require a validated rule, a tested bypass, and an operator procedure.
3. A new alert shows a Modbus write to a PLC coil from an HMI outside the normal batch schedule. What triage steps should the electrician take?
Read the worked answer
Treat it as a possible process change until proven otherwise. First, check the change-management log and batch schedule for an approved engineering or maintenance activity. Contact the shift supervisor and the HMI operator to confirm whether someone is making a legitimate change.
Second, preserve evidence: capture the packet, record source and destination IP, Modbus function code, coil address, timestamp, and HMI session user if available. Check whether the source HMI is the expected master and whether the write target is used by the batch recipe.
Third, do not auto-block or reboot the HMI immediately unless the process is already unsafe. If the write is unauthorized, isolate the HMI from the PLC VLAN at the switch or host firewall, not by shutting down the line. Escalate to the OT security engineer and plant management.
Finally, review why the alert fired outside schedule and whether the rule needs tuning. The judgment is to verify operational context first, preserve evidence, and contain at the network layer without causing a batch loss.