Segmenting a flat manufacturing network under quarterly downtime caps
Corvus Manufacturing acquired a regional rival and now has 6,800 employees across nine plants on a flat /16 network. The acquired plants run 1,400 industrial devices, some on Windows XP, that must send telemetry to a central historian. A penetration test moved from a phished office workstation to a programmable logic controller in 40 minutes. The board approved a segmentation programme but capped disruption at 30 minutes per plant per quarter. The network team proposes VLANs and ACLs on existing switches; the OT team wants air gaps; the security team wants microsegmentation with next-generation firewalls. A cloud ERP migration will add site-to-site VPN traffic. One plant uses a legacy label printer that broadcasts to the whole plant network, and the vendor says it cannot be patched or reconfigured. The plant manager refuses to replace it before peak season, which ends in five months. The programme has one network architect and two engineers.
1. Evaluate the three proposals and recommend an architecture and sequencing that fit the constraints.
Read the worked answer
Evaluation. A full air gap is not achievable: the historian needs telemetry from the plant floor and the ERP migration adds site-to-site traffic. Microsegmentation everywhere with next-generation firewalls is the right end state for critical controllers, but one architect and two engineers cannot design, test and operate hundreds of policies across nine plants within the downtime cap. VLANs and ACLs on existing switches are fast but easy to misconfigure and hard to audit at zone boundaries.
Recommendation: zone-and-conduit segmentation, then microsegmentation for critical assets. Define zones using IEC 62443 concepts: enterprise IT, plant DMZ, plant operations, safety systems, and isolated legacy devices. Put a next-generation firewall at the IT/OT boundary and at the historian; allow only the minimum flows. Use existing switches for local VLAN separation where risk is low, but do not rely on switch ACLs alone for the critical boundary. Terminate the cloud ERP VPN in the IT DMZ, never in OT.
Sequencing. Start with passive discovery and a traffic baseline, then block direct IT-to-OT paths except through a jump host. Pilot one plant: separate the label printer onto a dedicated VLAN with a local print server, ACLs to only that server, and broadcast containment. Because the printer is unpatched, add monitoring and plan replacement after peak season. Replicate plant by plant in the 30-minute quarterly windows with pre-staged configurations and rollback. Microsegment the highest-consequence controllers only after the zone model is stable.
2. How would you measure whether segmentation is working, and what would you do if a plant misses its change window?
Read the worked answer
Measure outcomes, not VLAN counts: the number of reachable IT-to-OT paths; the number of allowed cross-zone flows and their owners; time for a penetration tester to move from an office workstation to a controller; blocked or alerted policy violations; unplanned downtime during changes; and the percentage of plant assets with a known zone. A good sign is fewer paths and longer attacker dwell time, not just more firewall rules.
If a plant misses its window, do not make an unplanned change and do not bypass the boundary to keep production running. Pre-stage the configuration, agree a new window with the plant manager, and apply temporary compensating controls: tighten existing ACLs, monitor the flat path, and restrict remote access. Record the delay as a risk with an owner and an expiry date. If the delay crosses a critical period, the plant manager and CISO should sign a time-bound acceptance that states the exposure and the monitoring in place.
Report progress to the board quarterly using the same measures, and test one plant per quarter with a controlled attack simulation. The programme should also track exceptions such as the label printer so they do not become permanent architecture.