The Legacy SCADA Segmentation Decision
A water utility runs a treatment plant with 14 PLCs on a flat /24 OT subnet. A vendor recently installed a remote-support jump host that bridges the OT subnet to the corporate network so engineers can troubleshoot from HQ. The CISO wants to 'just add a firewall' between IT and OT. You are asked to review the design. Plant operations run 24/7 and cannot tolerate a mid-shift outage. The vendor's jump host has a shared local-admin password, no MFA, and is reachable from the corporate /16. OT devices speak Modbus/TCP and a proprietary protocol, and one PLC runs an unsupported Windows XP HMI. Management has approved budget for one maintenance window this quarter.
1. What is the single highest-risk element, and why does 'add a firewall' fail to address it?
Read the worked answer
The jump host is the highest risk: it is a bridge with shared credentials, no MFA, and broad reachability from a /16 corporate space. A firewall inserted between IT and OT does not fix a compromised or misused jump host, because the jump host is permitted traffic by design - it becomes the bypass. The correct framing is that the jump host is an identity and access control failure, not a perimeter gap. Mitigations that fit the constraint: (1) put the jump host on a dedicated management zone, not in the OT subnet; (2) require MFA and per-engineer accounts, remove shared local admin; (3) restrict source to a small set of admin workstations; (4) log and alert on every session. Firewall rules are necessary but insufficient - the design must assume the jump host can be compromised and limit what it can reach.
2. Given one maintenance window, sequence the changes and justify the order.
Read the worked answer
Order by risk reduction per unit of downtime, and prefer changes that need no OT outage:
- No-outage, high-value: rotate the shared password to per-user accounts, enable MFA on the jump host, restrict its source IPs, and turn on session logging. These are configuration changes on a single host and do not touch PLCs.
- No-outage network controls: add ACLs/firewall rules restricting OT-to-IT flows to only the jump host's management path; deny everything else. This is a policy change, not a device change.
- Windowed change: move the jump host to a management VLAN and place a firewall between IT and OT. This may briefly interrupt the vendor path but not the process control loop if done carefully.
- Deferred: the unsupported XP HMI is a real risk but replacing it is a project, not a window. Compensate now (isolate it, restrict access, monitor) and schedule replacement. Justification: the first two steps remove the most likely path to compromise without risking production; the windowed steps are structural but reversible; the XP replacement is a longer program.
3. How would you justify the residual risk to management if the XP HMI cannot be replaced this quarter?
Read the worked answer
Frame it as accepted, bounded, and monitored risk rather than ignored risk:
- Bounded: the HMI is isolated on its own segment with only the minimum necessary flows (to its PLC and to the jump host), and no internet or corporate reachability.
- Monitored: enable host logging where possible, network-level anomaly detection on that segment, and alerting on unexpected connections.
- Accepted with owner and expiry: document the risk owner (plant manager + CISO), the compensating controls, and a dated remediation plan. Review at each quarter.
- Business context: state the operational consequence of an outage versus the likelihood of exploitation, so management makes an informed decision. This turns an unmanaged legacy exposure into a governed exception, which is what auditors and regulators expect.