Flat Plant: OT Segmentation Versus a New Perimeter Firewall
Halden Precision operates a 640-employee automotive parts plant. Its 1,100 IT endpoints and 24 production PLCs sit behind a single firewall that permits any-to-any traffic between the front office, the MES servers and the line control network. The OT estate is run by an engineering team that reports to the plant manager, not the CISO. Unplanned line downtime is costed at $18,000 per hour.
Three system integrators support the PLCs remotely through a shared TeamViewer account whose password is written in the plant wiki. Line patching happens only during a two-day shutdown each August, and the PLC firmware is a release the vendor no longer supports.
A penetration test last month showed that a phished front-office laptop could reach a PLC over SMB in under four minutes, and that the MES server holds domain credentials in a plaintext configuration file. The plant director has budget for exactly one project this fiscal year and has already asked for quotes on a next-generation perimeter firewall.
1. The plant director wants the perimeter firewall replaced first. Rank the remediation work and justify the sequence against the evidence in the penetration test.
Read the worked answer
The perimeter refresh does not address the demonstrated attack path. The test moved from a phished office laptop to a PLC over SMB - an internal, east-west path. A new edge device inspects nothing on that path, so it would consume the year's budget while leaving the four-minute hop intact. Say this plainly and with the evidence, because "we bought a firewall" is a very persuasive story to a plant director.
Sequence:
- Block SMB and other non-required protocols between zones (days, near-zero cost). Host-to-PLC SMB is not needed for production; PLC program changes already happen in the August window, so the blocking change fits the existing maintenance constraint. Implement with switch ACLs or the existing firewall's rules - no new hardware.
- Kill the shared remote-access channel. Named integrator accounts, MFA, per-session approval and logging, brokered through a jump host in an OT DMZ. This removes a path that requires no phishing at all.
- Replace the plaintext domain credentials on the MES server. This is the most dangerous finding because it converts a network foothold into domain compromise; segmentation does not help once credentials work. Rotate, remove the account from privileged groups, and tier it.
- Proper zone-and-conduit design (IEC 62443 style): office, DMZ with the MES/historian, and line control zones, with documented ports and protocols only. The disruptive parts land in the August shutdown.
- Perimeter firewall last, justified on its own merits (vendor support, inspection) rather than as a fix for this finding.
Framing for the director: one hour of unplanned downtime pays for most of steps 1–3, and steps 1–3 close the path the test actually walked.
2. Design the replacement for the integrator remote-access arrangement, respecting the constraint that they must be able to respond during live production.
Read the worked answer
The current arrangement fails on every axis: a shared identity, a credential in a wiki, no session record, and no way to tell which integrator did what.
Target design
- Individual identity. Each integrator gets a named account federated to the company identity provider, with MFA. No shared accounts; if the vendor's contract requires their own tooling, that tool is a managed endpoint, not the access path.
- Brokered access through an OT jump host in a DMZ. The integrator connects inbound to the jump host only; the jump host has the narrowly scoped route to the PLC VLAN. The plant dials out; nothing accepts inbound connections from the internet into the control network.
- Two access modes. Scheduled sessions require a ticket and a plant engineer's approval. An emergency mode pages the on-call engineer and grants time-bound access (for example, a four-hour window) with mandatory post-hoc review - this is what makes the strict model survivable during a live stoppage.
- Session recording and command logging, retained for the audit period. Recordings are the only way to reconstruct what an integrator did when a line misbehaves after a support call.
- Least privilege. Integrator accounts do not get interactive logon to engineering workstations or domain credentials; they get the specific protocols needed to program the PLCs.
Operating it: quarterly attestation that each named integrator still works for the vendor, and automatic disablement at contract end. The wiki entry is deleted, not updated. Track session count and emergency-mode usage as the health metric - heavy emergency use means the scheduled process is too slow and should be tuned, not bypassed.
3. The engineering team objects that strict segmentation will break production and that the unsupported PLC firmware cannot be secured anyway. How do you respond and what compensating controls do you propose?
Read the worked answer
On "it will break production": the objection is legitimate for the disruptive changes and is exactly why the plan sequences non-disruptive controls first and stages the rest into the two-day August shutdown. Offer to run the ACL changes in monitor-only mode first and produce the actual traffic list, so the segmentation design is built from observed flows rather than assumptions. That converts an argument about opinions into a review of data, and it usually shortens the debate.
On "the firmware cannot be secured": correct, and irrelevant to whether segmentation is worth doing. Unsupported firmware means you cannot remove the vulnerability; it does not mean you cannot control who can reach it. Segmentation, protocol restriction and brokered access are compensating controls that reduce the probability of exploitation and the blast radius when it happens.
Compensating controls for the unsupported PLCs:
- Restrict reachability to the engineering VLAN and the jump host only; no office, no internet, no wireless.
- Deny SMB, RDP and other general-purpose protocols to the PLC subnet outright.
- Passive monitoring on the control network (span port or network tap) with alerting on new devices, new flows and programming actions outside the shutdown window.
- Application allow-listing and host firewalls on the engineering workstations - they are the usual route to the PLCs.
- A documented risk acceptance with an expiry date tied to the PLC refresh plan and a named owner. An acceptance without a date is a decision to never fix it.
Frame it for the plant manager in their currency: downtime cost, not compliance language. The controls are about preventing an unplanned stoppage that no August window can plan for.