Question

A manufacturing company operates a plant floor with programmable logic controllers (PLCs) and legacy SCADA systems that cannot be patched without vendor recertification and use unauthenticated, cleartext industrial protocols. The corporate IT network needs occasional access to production data for reporting. As the security architect, which approach BEST protects the industrial control environment while meeting the business requirement?

Accepted Answer

Implement a segmented architecture with a demilitarized zone (DMZ) containing a data historian, allowing IT to query the historian rather than reaching the control network directly

Answer

Deploy modern endpoint antivirus and full-disk encryption directly on each PLC and SCADA node to compensate for the outdated protocols

Answer

Place the SCADA systems on the same VLAN as corporate workstations but require multifactor authentication for all users accessing the plant floor

Answer

Expose the SCADA systems to the internet through a VPN so remote engineers and IT reporting tools can access real-time data on demand