Segmenting Nine Remote Well Pads with a Two-Firewall Budget
A midstream operator has nine remote well pads, each with a legacy PLC and RTU, connected by cellular routers to a central control room. The control room has three VLANs-operations, engineering, and business-all sharing one Layer 2 switch and a single firewall to the enterprise. Broadcast traffic from the RTUs periodically floods the operations VLAN, causing HMI timeouts. Engineering laptops with dual NICs are sometimes bridged between operations and business. The company wants IEC 62443 zones and conduits without replacing the RTUs, which cannot route IP multicast. Capital budget covers two industrial firewalls and one managed switch. The production manager insists on no downtime during harvest season, and the only maintenance window is a four-hour Sunday slot.
1. Where would you place the two industrial firewalls and the new managed switch to create defensible zones and conduits? Justify the placement against the stated constraints and identify what you would not do.
Read the worked answer
Place firewall A between the enterprise/business network and the combined operations/engineering environment; place firewall B between operations and engineering. Use the new managed switch at the cellular aggregation point to terminate the nine pad links into separate VLANs or small VLAN groups, with storm control and ACLs, then a single uplink into firewall B.
Do not try to give each pad its own firewall; the budget does not support it and the RTUs cannot route multicast. Do not treat VLANs as a security boundary between operations and engineering. The switch contains broadcast domains and enforces pad-to-pad isolation; the firewalls enforce zone-to-zone conduits. The enterprise firewall alone is insufficient because it leaves operations and engineering flat. Transparent mode may be needed for legacy protocols, but define explicit permit rules for HMI-to-PLC and historian traffic. Document conduits and deny all else. This design respects the four-hour window by pre-staging configurations and cutover in stages.
2. How do you address the broadcast flooding and the dual-NIC engineering laptops in the segmentation design?
Read the worked answer
Enable storm control and per-pad VLANs on the managed switch to stop broadcast flooding. If RTUs depend on broadcast for discovery, place only those RTUs in a small shared VLAN and document the exception. For dual-NIC laptops, disable bridging and unused NICs via Group Policy where possible, enforce port security and MAC limits, and put engineering laptops behind firewall B with explicit rules to operations. Do not allow the engineering VLAN to route directly to business. Use 802.1X if supported; otherwise static ACLs and unused-port shutdown. Test with one pilot pad before rolling out to all nine, and schedule the cutover in the Sunday window with a rollback configuration ready.
3. What residual risk remains after your design, and how would you document it for the IEC 62443 assessment?
Read the worked answer
Residual risk: cellular links are still untrusted, RTUs lack authentication, and switch/firewall configurations can drift. Document likelihood and impact, the conduits, compensating controls such as monitoring, and the fact that VLANs are not boundaries. Assign an owner and review date. For IEC 62443, show SL-A achieved versus SL-T; if SL-A is lower, record a gap and a remediation plan such as replacing RTUs, adding encrypted tunnels, or upgrading switches. Acceptance must be by the asset owner and security, with a sunset date and evidence that the controls were tested.