Network segmentation (IT/OT separation) in SCADA systems - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is network segmentation important in IT/OT environments?

In a SCADA system environment, why do organizations separate IT and OT networks?

A To allow unrestricted access between IT and OT networks for easier management

B To increase the speed of data transfer between IT and OT devices

C To reduce the risk of cyber attacks spreading between IT and OT systems

D To combine all devices into a single network for cost savings

💡 Hint

Think about how isolating parts of a network can protect critical systems.

Separating IT and OT networks limits the spread of cyber threats and protects critical operational technology from attacks originating in IT networks.

💻 Command Output

intermediate

Identify the firewall rule effect on IT/OT traffic

Given the following firewall rule, what will be the effect on traffic between IT and OT networks?

SCADA systems

iptables -A FORWARD -s 192.168.10.0/24 -d 10.0.0.0/24 -j DROP

A Blocks all traffic from IT network 192.168.10.0/24 to OT network 10.0.0.0/24

B Allows all traffic from OT network 10.0.0.0/24 to IT network 192.168.10.0/24

C Blocks all traffic from OT network 10.0.0.0/24 to IT network 192.168.10.0/24

D Allows all traffic between IT and OT networks

💡 Hint

Look at the source (-s) and destination (-d) IP ranges and the DROP action.

The rule drops packets originating from the IT network (192.168.10.0/24) destined for the OT network (10.0.0.0/24), blocking that traffic.

🔀 Workflow

advanced

Order the steps to implement IT/OT network segmentation

Arrange the following steps in the correct order to implement network segmentation between IT and OT networks.

A 1,2,3,4

B 1,3,2,4

C 3,2,1,4

D 3,1,2,4

💡 Hint

Think about understanding current state before defining zones.

First audit current devices and traffic (3), then define zones (1), configure controls (2), and finally monitor (4).

❓ Troubleshoot

advanced

Diagnose why OT devices cannot communicate with IT servers

OT devices cannot reach IT servers after segmentation. Which of the following is the most likely cause?

A Firewall rules are blocking OT to IT traffic

B OT devices have incorrect IP addresses in the IT subnet

C IT servers are powered off

D OT devices use unsupported protocols

💡 Hint

Consider what segmentation usually controls between networks.

Network segmentation often uses firewall rules to restrict traffic; blocking OT to IT traffic would cause communication failure.

✅ Best Practice

expert

Choose the best practice for secure IT/OT segmentation

Which practice best enhances security in IT/OT network segmentation?

A Use a single flat network for both IT and OT to reduce complexity

B Use a dedicated firewall with strict rules and monitor logs continuously

C Allow all traffic between IT and OT to simplify operations

D Disable all monitoring to avoid performance impact

💡 Hint

Think about how to keep networks secure and detect issues early.

Using dedicated firewalls with strict rules and continuous monitoring helps prevent attacks and quickly detect anomalies.