Flat Network, Ransomware Beacon, and an 11-Day OT Window
Northline Fabrication runs two plants and a 600-person office network. The core is a flat Layer 2 VLAN shared by 480 employee laptops, 40 servers, 14 PLCs, and 30 IP cameras. The only enforcement point is an internet-edge NGFW; inter-VLAN routing is done by an L3 switch with a permissive any-any rule between user, server, and OT subnets. On Tuesday, EDR flags a finance laptop making repeated SMB connections to 37 hosts and querying a newly registered domain every 90 seconds. The NGFW shows the same laptop sent 1.8 GB to that domain overnight. The plant manager says the PLCs cannot tolerate a scan or an outage, and the next maintenance window is 11 days away. You have three analysts, no NAC, and no OT asset inventory. The CFO asks whether to isolate the laptop, shut down the plant network, or wait for the maintenance window.
1. What is your first containment decision, and how do you justify the operational risk?
Read the worked answer
Reasoning: the endpoint shows two independent signs of compromise: SMB fan-out to 37 hosts and a regular beacon to a new domain, plus 1.8 GB of egress. Waiting 11 days gives the adversary time to move laterally and encrypt backups. Shutting the plant network is disproportionate because the evidence does not yet show PLC compromise, and a plant outage creates safety and physical risk.
Decision: use EDR network containment on the finance laptop immediately, block the domain at DNS and egress, preserve memory and disk, and collect the SMB target list. If EDR containment is unavailable, disable the switch port only after confirming the port does not serve PLCs or critical plant control. Do not scan OT. Start passive discovery and review the 37 SMB targets for signs of access. Notify plant engineering and the CFO with the scope of containment and the explicit decision not to touch OT until evidence requires it.
2. How should you sequence segmentation over the next 30 days with no OT asset inventory?
Read the worked answer
Reasoning: the highest-risk path is user-to-OT and user-to-server SMB, not OT-to-OT. Active scanning is unsafe for PLCs, so discovery must be passive and engineering-led.
Sequence: first, add temporary L3 ACLs or firewall policy to block SMB, RDP, and WinRM from user VLANs to the OT subnet and to server management interfaces. Second, permit only the specific server-to-PLC protocols documented by plant engineering. Third, restrict OT outbound internet to vendor support endpoints and block everything else. Fourth, use SPAN or firewall logs to build an asset inventory passively, then create an OT zone with PLCs and cameras separated from office users. Validate each rule in a change window with a rollback timer. Track blocked connection attempts as the inventory grows, and do not promise full segmentation until the OT asset list and protocol map are reviewed.
3. Which metrics would show the CFO that containment and segmentation are working?
Read the worked answer
Reasoning: alert counts alone are vanity metrics. The CFO needs evidence of reduced blast radius and faster containment.
Report: time from EDR detection to network containment for the index host; number of successful SMB connections from user VLANs to OT after ACLs; number of unauthorized egress attempts to newly registered domains; percentage of OT assets discovered passively; number of critical servers with management access restricted to an admin VLAN; and time to restore from backup in a tabletop test. Pair each metric with a baseline from the day before the incident. Also report unresolved exceptions, because a falling alert count can mean better blocking or simply missed telemetry.