Firewall and DMZ for SCADA in SCADA systems - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the purpose of a DMZ in SCADA networks

What is the primary purpose of placing a Demilitarized Zone (DMZ) between the SCADA network and the corporate network?

A To isolate SCADA systems from the corporate network and control external access securely

B To allow unrestricted access between SCADA and corporate networks for easy data sharing

C To replace firewalls entirely by using the DMZ as the only security layer

D To connect all SCADA devices directly to the internet for remote monitoring

💡 Hint

Think about how a DMZ acts like a buffer zone to protect sensitive systems.

A DMZ acts as a buffer zone that isolates the SCADA network from the corporate network, controlling and limiting access to protect critical systems from threats.

💻 Command Output

intermediate

Firewall rule effect on SCADA traffic

Given the following firewall rule on a SCADA firewall:

allow tcp from 192.168.10.0/24 to 10.0.0.5 port 502

What will be the effect of this rule?

A Blocks Modbus TCP traffic from 192.168.10.0/24 to 10.0.0.5 on port 502

B Blocks all traffic to 10.0.0.5 regardless of source

C Allows all traffic from 192.168.10.0/24 to 10.0.0.5 on any port

D Allows Modbus TCP traffic from 192.168.10.0/24 to 10.0.0.5 on port 502

💡 Hint

Port 502 is commonly used for Modbus TCP in SCADA systems.

The rule explicitly allows TCP traffic from the 192.168.10.0/24 subnet to the SCADA device at 10.0.0.5 on port 502, which is the standard Modbus TCP port.

❓ Troubleshoot

advanced

Diagnosing SCADA communication failure through firewall

A SCADA operator reports that the control center cannot communicate with a remote RTU (Remote Terminal Unit). The firewall between them has the following rules:

1. allow tcp from 10.1.1.0/24 to 192.168.100.10 port 102
2. deny all from any to any

What is the most likely reason communication is failing?

A The deny all rule blocks all traffic including allowed rules

B The allow rule is too specific and does not match the RTU's IP or port

C The firewall rules are correct; the problem is with the RTU hardware

D The allow rule should be placed after the deny all rule to work

💡 Hint

Check if the IP addresses and ports in the allow rule match the actual devices and protocols used.

The allow rule only permits TCP traffic from 10.1.1.0/24 to 192.168.100.10 on port 102. If the RTU uses a different IP or port, the traffic is blocked by the deny all rule.

🔀 Workflow

advanced

Proper sequence to configure a DMZ for SCADA

What is the correct order of steps to securely configure a DMZ between the corporate network and SCADA network?

A 2,1,3,4

B 2,3,1,4

C 1,2,3,4

D 3,2,1,4

💡 Hint

Think about physical setup before rules and testing last.

First, physically separate the DMZ network, then define firewall rules, place monitoring tools, and finally test everything to ensure security and functionality.

✅ Best Practice

expert

Choosing the best firewall strategy for SCADA security

Which firewall strategy best balances security and operational reliability for a SCADA system connected to a corporate network?

A Use a single firewall with open rules to simplify management

B Disable firewalls and rely on SCADA device authentication only

C Deploy multiple firewalls with a DMZ to isolate SCADA and corporate networks

D Allow all traffic from corporate to SCADA network during business hours

💡 Hint

Consider defense in depth and isolation principles.

Using multiple firewalls with a DMZ creates layers of defense, isolating critical SCADA systems from corporate networks and reducing attack surfaces while maintaining operational reliability.

Practice

1. What is the main purpose of a firewall in a SCADA system?

easy

A. To control and filter network traffic to protect SCADA devices

B. To store data collected from SCADA sensors

C. To provide power backup for SCADA devices

D. To physically connect SCADA devices to the internet

Solution

1. Step 1: Understand firewall function

   A firewall acts like a gatekeeper that controls which data can enter or leave a network.

2. Step 2: Apply to SCADA context

   In SCADA, it filters traffic to protect sensitive control systems from unauthorized access.

3. Final Answer:

   To control and filter network traffic to protect SCADA devices -> Option A

4. Quick Check:

   Firewall controls traffic = C [OK]

Hint: Firewalls filter traffic to protect systems [OK]

Common Mistakes:

• Confusing firewall with data storage
• Thinking firewall provides power
• Assuming firewall connects devices physically

2. Which of the following is the correct way to describe a DMZ in SCADA networks?

easy

A. A network zone that directly connects SCADA devices to the internet

B. A backup power supply for SCADA control centers

C. A secure area that isolates SCADA devices from other networks

D. A software tool for monitoring SCADA device performance

Solution

1. Step 1: Define DMZ purpose

   A DMZ (Demilitarized Zone) is a network area that separates internal systems from external networks.

2. Step 2: Apply to SCADA

   It isolates SCADA devices to reduce risk from outside attacks while allowing controlled access.

3. Final Answer:

   A secure area that isolates SCADA devices from other networks -> Option C

4. Quick Check:

   DMZ isolates SCADA = B [OK]

Hint: DMZ isolates SCADA from other networks [OK]

Common Mistakes:

• Thinking DMZ connects SCADA directly to internet
• Confusing DMZ with power backup
• Assuming DMZ is a software tool

3. Given this firewall rule snippet for a SCADA DMZ:

ALLOW TCP FROM 192.168.1.0/24 TO 10.0.0.5 PORT 502
DENY ALL FROM ANY TO 10.0.0.5 PORT 502

What will happen if a device with IP 192.168.1.10 tries to connect to 10.0.0.5 on port 502?

medium

A. Connection will be logged but not blocked

B. Connection will be denied

C. Connection will be allowed only if using UDP

D. Connection will be allowed

Solution

1. Step 1: Analyze the first rule

   The first rule allows TCP traffic from 192.168.1.0/24 subnet to 10.0.0.5 on port 502.

2. Step 2: Check the second rule

   The second rule denies all other traffic to 10.0.0.5 on port 502.

3. Step 3: Determine rule precedence

   Firewall rules are processed top-down; the first matching rule applies.

4. Final Answer:

   Connection will be allowed -> Option D

5. Quick Check:

   Allow rule matches first = A [OK]

Hint: First matching rule applies in firewall rules [OK]

Common Mistakes:

• Ignoring rule order and choosing deny
• Confusing TCP with UDP protocols
• Assuming all traffic is denied by default

4. A SCADA firewall configuration has this rule:

DENY TCP FROM ANY TO 10.0.0.10 PORT 80

But users report they can still access the web interface on 10.0.0.10. What is the most likely cause?

medium

A. The rule is placed after an ALLOW rule that permits the traffic

B. The firewall does not support TCP filtering

C. Port 80 is not the correct port for web access

D. The IP address 10.0.0.10 is incorrect

Solution

1. Step 1: Understand firewall rule order

   Firewall rules are processed in order; the first matching rule applies.

2. Step 2: Identify rule placement issue

   If a prior ALLOW rule permits traffic to 10.0.0.10 on port 80, the DENY rule after it will not block it.

3. Final Answer:

   The rule is placed after an ALLOW rule that permits the traffic -> Option A

4. Quick Check:

   Rule order affects blocking = A [OK]

Hint: Check rule order; first match wins [OK]

Common Mistakes:

• Assuming firewall ignores TCP filtering
• Thinking port 80 is wrong without checking
• Assuming IP address is incorrect without evidence

5. You want to design a SCADA network with a DMZ to isolate control devices from the corporate network. Which setup best improves security?

hard

A. Allow all traffic between corporate network and SCADA devices for easy access

B. Place SCADA devices in the DMZ and allow only specific traffic from the corporate network through a firewall

C. Place SCADA devices behind the corporate firewall without a DMZ

D. Connect SCADA devices directly to the corporate network with no firewall

Solution

1. Step 1: Understand DMZ role in SCADA

   A DMZ isolates SCADA devices from the corporate network to reduce attack risk.

2. Step 2: Apply firewall rules

   Allow only specific, necessary traffic from corporate network to SCADA devices through firewall.

3. Step 3: Evaluate options

   Place SCADA devices in the DMZ and allow only specific traffic from the corporate network through a firewall uses DMZ and firewall properly; others expose SCADA or allow unsafe access.

4. Final Answer:

   Place SCADA devices in the DMZ and allow only specific traffic from the corporate network through a firewall -> Option B

5. Quick Check:

   DMZ + filtered firewall access = D [OK]

Hint: Use DMZ plus filtered firewall rules for SCADA security [OK]

Common Mistakes:

• Connecting SCADA directly to corporate network
• Skipping DMZ and relying on firewall only
• Allowing all traffic for convenience