Wormable HMI Flaw on a Live Filling Line
You are CISO of a specialty chemicals manufacturer with 22 plants. One site runs its filling and packaging line on Siemens S7-300 PLCs controlled by HMIs on Windows Server 2008 R2, with a flat Layer-2 network bridged to the corporate IT estate so production output can feed MES and ERP reporting. The line generates $4.2m of revenue per month at full utilisation; the plant runs 24/6 with a single annual shutdown. Your vulnerability scanner just flagged a CVSS 9.8 wormable flaw in the HMI software - no authentication required, remote code execution. There is no evidence of exploitation, but a remote-support jump host on that segment is reachable from the internet through a vendor VPN. The automation vendor states that the patched HMI requires an OS upgrade and validated re-qualification of the line, which they will only support during a six-week shutdown next year. Corporate IT wants to deploy its standard EDR agent on the HMIs immediately to close the ticket.
1. What do you do in the next 14 days? Justify each action against the actual risk, not the CVSS score.
Read the worked answer
What CVSS 9.8 does and does not tell me: it says the flaw is severe if reachable. Actual risk is set by the path - a vendor VPN to an internet-reachable jump host on a flat segment bridged to corporate IT. I fix the path first.
Next 14 days:
- Vendor remote access - remove standing access, move to just-in-time with MFA, session recording and source-IP restriction. Highest value, lowest cost, can be done today.
- Remove the Layer-2 bridge. Replace the flat connection with a controlled path - historian or DMZ with one-way data flow, OPC UA with allow-listed endpoints. If a redesign cannot land in 14 days, apply strict firewall rules between line and corporate allowing only the MES ports and directions required.
- HMI hardening - application allow-listing, disable unused services and USB ports, restrict interactive logon to named engineering accounts, and place an IPS in front of the HMI subnet to block the known exploit signature (virtual patching).
- Detection - passive network monitoring on the OT segment. I do not put active scanning on a live PLC network.
- Vendor negotiation - press for an emergency patch or supported mitigation outside the annual shutdown, and get their position in writing.
Risk acceptance: signed with the plant manager, documenting residual risk and interim controls, reviewed monthly until the shutdown. Availability on a filling line is a safety property, so every control is assessed for its effect on the process, not only its security benefit. A control that stops the line is not a win.
2. IT wants EDR agents on the HMIs immediately. What is your decision, and what conditions would change it?
Read the worked answer
Decision: not a blanket deployment. EDR on an HMI is a change to a validated production control system, and the risk of the control failing is not symmetrical with the risk of the threat.
Reasoning:
- HMI and engineering-station images are frequently validated with the automation vendor. Unsupported kernel-level agents can cause resource contention, delayed HMI refresh, reboots after signature updates, or driver conflicts. On a line where a failed batch or a stuck valve is a safety event, that is not a ticket.
- The vendor may decline support for a modified host. That is a contractual and operational risk, not an IT preference, and it lands on operations, not on the service desk that raised the request.
What I do first instead:
- EDR on the DMZ hosts, historian and MES servers, where compromise is likely and safety impact is lower.
- Passive network detection on the OT segment plus application allow-listing on the HMI, which addresses the most common execution path with far less operational risk.
Conditions that would change my decision: written vendor approval of the specific agent version; successful validation on a duplicate HMI in a lab running the real HMI application; a staged pilot on one non-critical line with a rollback plan and operations sign-off; tuned exclusions; and a change window agreed with production. Then I extend it line by line - not plant-wide in one night. The decision is about sequence and evidence, not about refusing visibility.
3. How do you secure executive funding and operations cooperation for segmentation of the line?
Read the worked answer
Frame it as production risk, not cyber risk. The plant manager does not own 'security'; they own uptime, quality and safety. The case is: a single wormable path from the internet to a line producing $4.2m a month, with a six-week recovery dependency on a vendor and an annual shutdown as the only maintenance window.
Elements of the business case:
- Exposure quantified - revenue per day of downtime, order backlog impact, contractual penalties, and the insurance deductible if the insurer excludes unsegmented OT.
- Cost of the fix, phased - quick wins (VPN controls, firewall rules, allow-listing) funded from operating budget within weeks; segmentation aligned to planned shutdowns so no additional downtime is created. Aligning to shutdowns is what turns operations into a partner rather than a blocker.
- Co-ownership - the segmentation plan is signed jointly by the plant manager and me, with joint reporting to the executive committee. Shared ownership removes the 'IT is slowing production' dynamic that kills OT programmes.
- External leverage - customer audits, the insurer's questions and the vendor's own advisory often persuade executives more than my risk register does.
- Options, not a demand - a minimum acceptable path and a preferred path, each with dates and costs, plus a written statement of what happens if neither is funded, with a named acceptor.