Firewall and DMZ for SCADA in SCADA systems - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the purpose of a DMZ in SCADA networks

What is the primary purpose of placing a Demilitarized Zone (DMZ) between the SCADA network and the corporate network?

A To isolate SCADA systems from the corporate network and control external access securely

B To allow unrestricted access between SCADA and corporate networks for easy data sharing

C To replace firewalls entirely by using the DMZ as the only security layer

D To connect all SCADA devices directly to the internet for remote monitoring

💡 Hint

Think about how a DMZ acts like a buffer zone to protect sensitive systems.

A DMZ acts as a buffer zone that isolates the SCADA network from the corporate network, controlling and limiting access to protect critical systems from threats.

💻 Command Output

intermediate

Firewall rule effect on SCADA traffic

Given the following firewall rule on a SCADA firewall:

allow tcp from 192.168.10.0/24 to 10.0.0.5 port 502

What will be the effect of this rule?

A Blocks Modbus TCP traffic from 192.168.10.0/24 to 10.0.0.5 on port 502

B Blocks all traffic to 10.0.0.5 regardless of source

C Allows all traffic from 192.168.10.0/24 to 10.0.0.5 on any port

D Allows Modbus TCP traffic from 192.168.10.0/24 to 10.0.0.5 on port 502

💡 Hint

Port 502 is commonly used for Modbus TCP in SCADA systems.

The rule explicitly allows TCP traffic from the 192.168.10.0/24 subnet to the SCADA device at 10.0.0.5 on port 502, which is the standard Modbus TCP port.

❓ Troubleshoot

advanced

Diagnosing SCADA communication failure through firewall

A SCADA operator reports that the control center cannot communicate with a remote RTU (Remote Terminal Unit). The firewall between them has the following rules:

1. allow tcp from 10.1.1.0/24 to 192.168.100.10 port 102
2. deny all from any to any

What is the most likely reason communication is failing?

A The deny all rule blocks all traffic including allowed rules

B The allow rule is too specific and does not match the RTU's IP or port

C The firewall rules are correct; the problem is with the RTU hardware

D The allow rule should be placed after the deny all rule to work

💡 Hint

Check if the IP addresses and ports in the allow rule match the actual devices and protocols used.

The allow rule only permits TCP traffic from 10.1.1.0/24 to 192.168.100.10 on port 102. If the RTU uses a different IP or port, the traffic is blocked by the deny all rule.

🔀 Workflow

advanced

Proper sequence to configure a DMZ for SCADA

What is the correct order of steps to securely configure a DMZ between the corporate network and SCADA network?

A 2,1,3,4

B 2,3,1,4

C 1,2,3,4

D 3,2,1,4

💡 Hint

Think about physical setup before rules and testing last.

First, physically separate the DMZ network, then define firewall rules, place monitoring tools, and finally test everything to ensure security and functionality.

✅ Best Practice

expert

Choosing the best firewall strategy for SCADA security

Which firewall strategy best balances security and operational reliability for a SCADA system connected to a corporate network?

A Use a single firewall with open rules to simplify management

B Disable firewalls and rely on SCADA device authentication only

C Deploy multiple firewalls with a DMZ to isolate SCADA and corporate networks

D Allow all traffic from corporate to SCADA network during business hours

💡 Hint

Consider defense in depth and isolation principles.

Using multiple firewalls with a DMZ creates layers of defense, isolating critical SCADA systems from corporate networks and reducing attack surfaces while maintaining operational reliability.