Microsegmentation in a Plant That Cannot Stop
Helix Components runs three automotive parts lines in Ohio, each controlled by PLCs and engineering workstations on a single flat VLAN shared with corporate IT. A peer manufacturer suffered a ransomware incident that halted production for nine days. Helix's board approved a six-month, $400,000 security architecture program. The plant manager insists any solution must not require agents on the PLCs or engineering workstations, some of which run Windows XP and cannot be patched; the only maintenance window is two hours per quarter. IT proposes agent-based microsegmentation across all servers and endpoints. The OT lead proposes IEC 62443-style zones and conduits with an industrial DMZ, unidirectional gateways for historian data, and passive network monitoring. The CISO must choose an approach that reduces blast radius without risking a line stoppage, and must show measurable progress to the board within 90 days.
1. Compare the IT microsegmentation proposal and the OT zones-and-conduits proposal. Which should the CISO approve, and why?
Read the worked answer
The CISO should approve a hybrid that leads with zones and conduits, not an agent-first microsegmentation rollout. The IT proposal conflicts with two hard constraints: agents cannot be installed on the PLCs or some engineering workstations, and Windows XP hosts are unsupported by modern agent software. A six-month timetable for agent-based segmentation across three production lines is also unrealistic given the two-hour quarterly maintenance window. Attempting it would create pressure to bypass change control, which is exactly how an architecture project causes an outage.
The OT proposal is more defensible because it reduces blast radius through network control rather than host agents. Zones and conduits map the plant into control, supervisory, and enterprise layers; an industrial DMZ brokers historian and ERP traffic; unidirectional gateways prevent inbound paths to the control zone; passive monitoring gives visibility without touching the PLCs. That directly addresses the peer manufacturer's failure mode: ransomware spreading from corporate IT into production.
The CISO should still add host controls where they are feasible, such as application allowlisting on supported HMIs and EDR on IT servers, but should not make those the first dependency. The decision criterion is not which architecture is more modern; it is which one can be deployed without a line stoppage while materially shrinking the path from corporate IT to the PLCs.
2. Sequence the first 90 days. What gets done first, what is deferred, and how do you avoid a big-bang cutover?
Read the worked answer
Days 1–30: build an accurate asset and flow inventory. Identify every conduit between corporate IT, the DMZ, the supervisory zone, and each line's control zone. Find quick, low-risk wins: remove direct internet access from engineering workstations, disable unused switch ports, segment the historian behind the DMZ, and verify offline backups for PLC programs and engineering configurations. Do not change production firewall rules yet.
Days 31–60: define and test conduit rules in one line during a maintenance window. Use passive monitoring first to baselined required traffic, then enforce deny-by-default rules in monitor mode before blocking. Stand up the industrial DMZ and move the historian connection there. Test rollback explicitly; the plant manager needs a proven way to restore the previous path within the two-hour window.
Days 61–90: extend the tested pattern to the second line, then the third, with a go/no-go review after each. Defer full asset inventory automation and any agent rollout on unsupported hosts. Report to the board in terms of conduits controlled, blocked flows, and mean time to detect, not 'percent segmented'. A big-bang cutover across all three lines in one window is the main risk; serial rollout with rollback is the control.
3. The plant manager asks for a permanent exception for the Windows XP PLCs. How should the CISO respond, and what would make a time-bound exception defensible?
Read the worked answer
The CISO should refuse 'permanent' and offer a time-bound exception with explicit compensating controls. A permanent exception for an unpatchable control-system component is a statement that the risk will never be revisited, which is neither credible nor auditable. The defensible position is: the PLCs cannot be patched, so the architecture must ensure they are not reachable from corporate IT or the internet, and the exception must expire.
A defensible record would include: the exact hosts and firmware versions; a network diagram showing the conduit and the deny rules; confirmation that no direct internet path exists; passive monitoring coverage and alerting on new connections; physical and USB controls for engineering workstations; offline backups of PLC logic; a vendor-supported migration roadmap with funding; and an incident response plan that accounts for losing a line. The exception should be reviewed quarterly against those conditions and should expire when the migration is complete or when the vendor drops support entirely.
The CISO should also state what would invalidate the exception immediately: a new conduit, an unexplained connection attempt, or a vendor vulnerability with a public exploit. That gives the plant manager certainty without giving the organization a permanent blind spot.