IT/OT segmentation and vendor access at a water utility
Riverbend Water Authority operates 14 treatment plants and 120 pump stations. The OT network has about 3,000 assets: Allen-Bradley PLCs, Wonderware HMIs, Modbus RTU-to-TCP gateways, and cellular RTUs. IT and OT converge at each plant through a FortiGate 60F; FortiSwitch 124E provides access, FortiAP 231F provides coverage, FortiNAC handles device onboarding, and FortiSIEM collects logs. The utility follows a Purdue model but has flat VLANs at six small plants. A maintenance vendor needs remote access to a specific PLC for four weeks. During a recent IT-side broadcast storm, OT HMIs lost visibility to PLCs for 20 minutes. The FortiGate IPS profile is blocking Modbus writes from a trusted engineering workstation after a signature update. The OT team refuses firmware changes on PLCs and has no maintenance window for two months. The CISO wants segmentation, safe vendor access, and continued Modbus visibility.
1. Propose a segmentation and traffic-control design for the six flat plants, including where to enforce policy and how to avoid breaking Modbus.
Read the worked answer
Design: at each flat plant, create zones: IT/guest, OT DMZ, OT supervisory (HMIs/historians), OT control (PLCs/RTUs), and safety. Use the FortiGate 60F as the inter-zone firewall, FortiSwitch 802.1Q trunks, and FortiNAC for dynamic VLAN assignment. Put the IT/OT boundary on the FortiGate with deny-by-default; allow only the engineering jump host to reach specific PLC IPs on TCP 502, and only required HMI-to-PLC flows. Do not rely on a flat VLAN ACL alone.
Avoid breaking Modbus: build a flow matrix from FortiSIEM/FortiGate logs before enforcing; start in monitor mode; use industrial protocol signatures in monitor/learn mode; allow legitimate function codes; enable storm control and broadcast suppression on FortiSwitch access ports; and keep a rollback VLAN profile.
Why: segmentation must be enforceable at the FortiGate, not just documented. The broadcast storm shows that IT-OT boundary policy and storm control are missing.
2. Design time-bound vendor access to the PLC that satisfies least privilege and auditability without a PLC firmware change.
Read the worked answer
Vendor access: create a time-limited local user or Entra ID guest with FortiToken MFA, expiring at the end of four weeks. Terminate SSL VPN or ZTNA on the plant FortiGate into a vendor VLAN. Allow only RDP/SSH to a hardened jump host, not direct PLC access; the jump host has the PLC programming software and a second policy to the specific PLC IP on the required port. Record sessions with FortiGate logging and, if available, a jump-host recorder. Use a schedule and auto-expire the account; alert on login outside the window.
Why not direct PLC access: direct vendor-to-PLC access bypasses least privilege and auditability. The jump host gives a controlled, logged path and limits lateral movement.
Audit: FortiAnalyzer reports for vendor logins, policy hits, and session duration; FortiSIEM correlation for failed MFA and anomalous commands.
3. The IPS is blocking legitimate Modbus writes. What is your immediate and long-term response, and how do you prevent recurrence?
Read the worked answer
Immediate: identify the signature and the blocked function code. If the write is legitimate (for example a setpoint change from the engineering workstation), set that IPS signature to monitor/pass with logging only for the specific source-to-destination pair, or create an exception in the IPS sensor. Do not disable the entire IPS profile. Confirm the PLC accepts the write and monitor for unexpected changes.
Long-term: baseline Modbus function codes and PLC addresses; build a custom industrial IPS profile with virtual patching for known PLC vulnerabilities; stage signature updates in monitor mode before enforcing on OT; use FortiManager change control and FortiAnalyzer alerts for signature changes.
Prevent recurrence: document the legitimate engineering workflow, test after every signature update, and keep a break-glass exception with expiry. In OT, availability and safety outrank blanket blocking; compensating controls and logging are acceptable when patching is impossible.