Staged Segmentation of a Flat OT Plant Network
Helios Foods runs a 24/7 plant with 1,100 OT assets, including 14 Windows XP HMIs, 9 PLC cells and 3 remote maintenance vendors with always-on VPN accounts. The plant network is a flat 10.0.0.0/16 shared with corporate IT; there is no asset inventory and the perimeter firewall is five years past end of support. A consultant proposes 14 VLANs with strict inter-VLAN deny rules, but production engineering will grant only one four-hour maintenance window per quarter for changes and insists that vendor maintenance continue uninterrupted. The CISO has asked for a risk-based segmentation plan that can start without a full shutdown, using ISO/IEC 27033-2 and -3 as guidance. Safety systems must remain isolated from business IT, and any exception must be documented and time-bound.
1. How should the team use ISO/IEC 27033-3 reference scenarios and risk assessment to prioritize segmentation?
Read the worked answer
Use 27033-3 as a threat-and-control catalogue, not a segmentation recipe. First build a minimal asset and data-flow inventory for the 1,100 OT assets and the three vendor paths; without this, 14 VLANs are arbitrary. Map each asset to a reference scenario: control-system zones, remote maintenance, corporate-to-plant interconnection and wireless if present. Then run a risk assessment that scores safety, availability, quality and confidentiality separately, because a loss of view in the HMI may be more serious than a transient IT outage. Prioritise segmentation of safety systems and vendor maintenance first: these are the highest-consequence conduits and can often be isolated with firewall/VPN policy changes that do not require re-IP the flat /16. Next isolate the PLC/HMI cells from corporate IT. Use 27033-2 for design steps and verification criteria. The 14-VLAN target can remain the end state, but the risk assessment should decide the order, not the VLAN count.
2. Propose a staged target architecture with zones, conduits and compensating controls that can start before the next quarterly window.
Read the worked answer
Propose a staged zone/conduit model. Zone 1: safety systems, physically or logically isolated, with no route to business IT and change control requiring safety sign-off. Zone 2: control cells (PLC/HMI), with conduits only to their supervisory servers and a deny-by-default rule set. Zone 3: plant supervisory/DMZ for historians and jump hosts. Zone 4: corporate IT, reached only through a firewall and a mediated jump host. Zone 5: vendor access, terminated in a controlled remote-access gateway with MFA, time windows, session recording and no always-on accounts. Compensating controls for the interim: disable vendor always-on VPN and replace with scheduled, monitored sessions; put the XP HMIs on a dedicated segment with host firewalls and restrictive ACLs; replace the unsupported perimeter firewall first; enable netflow/logging at the plant boundary. Each stage needs rollback and a four-hour window plan. Do not promise full segmentation in one quarter; promise verifiable reduction of the highest-risk paths.
3. Production refuses the change window and demands no interruption. How should the CISO handle risk acceptance and exceptions?
Read the worked answer
Production's constraint is real but it does not transfer risk ownership. The CISO should present the risk assessment: safety and availability impact, likelihood of vendor credential misuse, and the unsupported firewall. Offer a menu: accept the risk explicitly with a time-bound exception, or fund the staged controls. An exception must state the risk owner (plant director), the compensating controls, the expiry date and the review trigger. The CISO cannot silently accept residual risk on behalf of safety. If production refuses the maintenance window, escalate through the risk committee with a decision record. Use 27033-2 verification to show that staged changes can be tested in a lab or during the quarterly window, reducing the argument that segmentation requires a shutdown. Revisit the exception quarterly and tie it to the firewall replacement and vendor-access remediation. This is a governance test: documented, owned and time-bound acceptance, not an informal 'production said no'.