Question

A manufacturing company operates a plant with an OT network organized according to the Purdue model. Level 2 (supervisory/SCADA) and Level 1 (PLCs/RTUs) devices communicate over several VLANs that trunk into a core industrial switch. Security architects must design monitoring with Microsoft Defender for IoT that provides visibility into device-to-device traffic and protocol-level anomalies (e.g., Modbus, DNP3) without introducing any latency or risk to the control processes. What should the design specify?

Accepted Answer

Deploy a network sensor connected to a SPAN/mirror port (or network TAP) on the core industrial switch, configured to receive the OT VLAN traffic for passive deep packet inspection

Answer

Install the Defender for Endpoint agent on each PLC and RTU so protocol anomalies can be reported directly to the cloud

Answer

Place the sensor inline between the core switch and Level 1 devices so it can block malicious industrial protocol commands in real time

Answer

Rely on Defender for IoT enterprise (agentless) integration through Defender for Endpoint to discover the OT devices via corporate network scans