Question

A manufacturing company runs its plant floor SCADA and PLC systems on the same network as its corporate IT workstations and internet-facing services. After a ransomware incident on the corporate side nearly spread to the industrial controllers, the SOC is asked to recommend a segmentation approach that isolates the OT environment while still permitting a limited, controlled data flow (historian polling) to the IT side. Which segmentation design best meets this requirement?

Accepted Answer

Deploy an industrial DMZ (IDMZ) between the OT and IT zones, placing brokered services like the data historian in the DMZ and denying all direct OT-to-IT and IT-to-OT traffic

Answer

Place all OT and IT devices in a single large VLAN and rely on host-based firewalls on the PLCs to block ransomware

Answer

Assign the OT devices static IP addresses in a separate subnet but leave routing fully open so plant engineers can reach controllers from any workstation

Answer

Move the corporate internet-facing services into the same subnet as the SCADA systems to consolidate monitoring under one firewall rule set