Segmentation and FIPS in a Live Factory
Vantage Fabrication operates a plant with a flat /16 OT network. Fourteen legacy PLCs run a proprietary broadcast protocol; a safety instrumented system shares the same switches as the historian and the enterprise IT uplink. The historian runs Windows Server 2008 and receives data from PLCs. Vendors connect through a shared TeamViewer account to troubleshoot, often at 2 a.m. A federal contract now requires FIPS 140-2 validated cryptography for data at rest. The CIO wants a zero-trust architecture and “encrypt everything” within 12 months; the plant manager refuses any change that risks production or safety. A prior firewall pilot caused a 40-minute outage because PLC broadcast traffic was blocked. The plant runs 24/7, and downtime costs $40,000 per hour.
1. Propose a segmentation design that improves security without disrupting PLC broadcast traffic or the safety instrumented system.
Read the worked answer
Use the Purdue model as a reference, but adapt it to plant reality. Keep the safety instrumented system on its own isolated network with no route to IT; do not insert an inline firewall into the safety loop. Create cell or zone VLANs for PLCs and allow the proprietary broadcast traffic only inside each cell. Place an industrial firewall between OT cells and IT, and put the historian in an OT DMZ with brokered or one-way data flow to IT. Remove direct IT-to-PLC routes. Because the earlier pilot failed, proceed in phases: passive discovery first, then allow-list observed flows, then enforcement in a maintenance window. Remote vendor access should terminate at a jump host in the OT DMZ, not at the PLCs. This design reduces lateral movement while preserving broadcast domains and safety availability.
2. What does FIPS 140-2 require in this environment, and what cannot realistically be encrypted?
Read the worked answer
FIPS 140-2 applies to cryptographic modules protecting data at rest, so the practical scope is the historian database, backups, management server volumes, and configuration backups. Those should use FIPS-validated modules and documented key management. You cannot realistically encrypt the PLC backplane or proprietary protocol without vendor support and safety validation, and promising “encrypt everything” would be misleading. Compensate for those exceptions with physical controls, network isolation, strict access control, and monitoring. Key management should use an HSM or validated key store, separation of duties, rotation, backup, and audit. Document the exceptions and the residual risk for the federal customer and the CIO. The goal is defensible scope, not a blanket claim that every component is encrypted.
3. How should the shared TeamViewer vendor access be replaced?
Read the worked answer
Replace shared TeamViewer with a privileged access gateway in the OT DMZ. Each vendor technician should have a unique account, MFA, just-in-time approval, and access limited to the specific assets needed for the ticket. Record sessions, log commands, and review them. Require vendor access only during approved maintenance windows, with plant engineering approval. Remove direct internet paths to PLCs and the historian. Contractually require the vendor to use the gateway and to notify Vantage of security incidents. This also provides attribution that the shared account cannot provide. If a vendor refuses, escalate through procurement and allow access only under supervised sessions until the contract is corrected.