Automotive Assembly Plant: Contractor Laptop and Wireless Cells
An automotive assembly plant has 480 robots in 12 welding cells, controlled by PLCs and scheduled by a MES. Engineering uses a shared 'celladmin' account whose password is posted in each cell. Wireless torque tools connect through an access point that bridges into the cell VLAN. Last month a contractor's infected laptop caused a 45-minute MES outage and 320 vehicles were lost. IT proposes to move the MES onto the corporate domain, enforce group policy and monthly patching, but the MES vendor says the application is not supported after the current OS is patched. Production runs three shifts, six days a week; the only downtime is a four-hour Sunday window. The plant has no OT incident response plan and no network monitoring in the cells.
1. Evaluate IT's proposal to domain-join the MES and apply group policy and monthly patching. What would you accept, reject, or modify?
Read the worked answer
Accept the intent to improve identity and patch discipline, but reject applying corporate group policy and monthly patching directly to the MES. The MES is in the OT zone; domain-joining it creates a conduit to corporate domain controllers and exposes it to IT changes that the vendor does not support. I would require the MES to remain in a defined OT zone, with a controlled conduit to the corporate identity service only if needed. If domain join is required, use a dedicated OU, restricted GPOs, no generic software deployment, and change control. Patching should follow an OT patch process with vendor approval and a test environment, not the IT calendar. The MES outage already showed that a contractor laptop can cross the boundary; the priority is segmentation and monitoring, not domain membership. If IT insists, ask for a written support statement from the MES vendor and a rollback plan.
2. The contractor laptop incident and wireless bridge are related. Recommend containment and architecture changes for the cell VLAN and wireless tools, including immediate actions.
Read the worked answer
Immediate: remove the wireless bridge to the cell VLAN, disable the contractor account, and scan the MES and cell switches for the laptop's lateral movement. Put contractor devices on a separate guest/contractor VLAN with no route to cells; require NAC and endpoint checks. For torque tools, use a dedicated SSID mapped to a tool VLAN, WPA2/3 Enterprise with per-device credentials or certificate, MAC allowlisting and a firewall to the cell PLCs that allows only the required torque protocol. Do not bridge wireless to the cell VLAN. Segment the 12 cells from each other and from the MES; allow only the MES-to-PLC traffic needed. Add flow monitoring and alerts on the cell switches. These are 62443-3-3 FR5 restricted data flow and FR1 identification/authentication controls. The contractor incident should trigger an OT incident response review, not just a password change.
3. Build a minimal OT incident response capability that fits the plant's constraints. Include roles, first-hour actions, and how it interfaces with corporate IT.
Read the worked answer
Build a minimal plan that fits three shifts and a four-hour Sunday window. Name an OT incident commander, an OT security lead, a production lead, a safety lead and a communications lead; give a 24/7 contact path. Write playbooks for the top three scenarios: contractor laptop malware, MES ransomware, and a compromised cell switch. First-hour actions: confirm safety, isolate affected VLANs at the switch rather than powering off robots, preserve logs, notify IT SOC and plant management, and use the pre-approved isolation list. Maintain offline backups of MES and PLC configurations and test restore quarterly. Interface with corporate IT through a joint escalation procedure: IT handles the corporate network and identity; OT decides on plant isolation. Run a tabletop and a small live exercise in the Sunday window. Track metrics: time to detect, time to isolate, restore time. This is 62443-2-1 incident response and business continuity, scaled to the plant.