Network segmentation (IT/OT separation) in SCADA systems - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is network segmentation important in IT/OT environments?

In a SCADA system environment, why do organizations separate IT and OT networks?

A To allow unrestricted access between IT and OT networks for easier management

B To increase the speed of data transfer between IT and OT devices

C To reduce the risk of cyber attacks spreading between IT and OT systems

D To combine all devices into a single network for cost savings

💡 Hint

Think about how isolating parts of a network can protect critical systems.

Separating IT and OT networks limits the spread of cyber threats and protects critical operational technology from attacks originating in IT networks.

💻 Command Output

intermediate

Identify the firewall rule effect on IT/OT traffic

Given the following firewall rule, what will be the effect on traffic between IT and OT networks?

SCADA systems

iptables -A FORWARD -s 192.168.10.0/24 -d 10.0.0.0/24 -j DROP

A Blocks all traffic from IT network 192.168.10.0/24 to OT network 10.0.0.0/24

B Allows all traffic from OT network 10.0.0.0/24 to IT network 192.168.10.0/24

C Blocks all traffic from OT network 10.0.0.0/24 to IT network 192.168.10.0/24

D Allows all traffic between IT and OT networks

💡 Hint

Look at the source (-s) and destination (-d) IP ranges and the DROP action.

The rule drops packets originating from the IT network (192.168.10.0/24) destined for the OT network (10.0.0.0/24), blocking that traffic.

🔀 Workflow

advanced

Order the steps to implement IT/OT network segmentation

Arrange the following steps in the correct order to implement network segmentation between IT and OT networks.

A 1,2,3,4

B 1,3,2,4

C 3,2,1,4

D 3,1,2,4

💡 Hint

Think about understanding current state before defining zones.

First audit current devices and traffic (3), then define zones (1), configure controls (2), and finally monitor (4).

❓ Troubleshoot

advanced

Diagnose why OT devices cannot communicate with IT servers

OT devices cannot reach IT servers after segmentation. Which of the following is the most likely cause?

A Firewall rules are blocking OT to IT traffic

B OT devices have incorrect IP addresses in the IT subnet

C IT servers are powered off

D OT devices use unsupported protocols

💡 Hint

Consider what segmentation usually controls between networks.

Network segmentation often uses firewall rules to restrict traffic; blocking OT to IT traffic would cause communication failure.

✅ Best Practice

expert

Choose the best practice for secure IT/OT segmentation

Which practice best enhances security in IT/OT network segmentation?

A Use a single flat network for both IT and OT to reduce complexity

B Use a dedicated firewall with strict rules and monitor logs continuously

C Allow all traffic between IT and OT to simplify operations

D Disable all monitoring to avoid performance impact

💡 Hint

Think about how to keep networks secure and detect issues early.

Using dedicated firewalls with strict rules and continuous monitoring helps prevent attacks and quickly detect anomalies.

Practice

1. What is the main purpose of network segmentation between IT and OT systems in SCADA environments?

easy

A. To improve security by separating critical industrial systems from general IT networks

B. To increase the speed of data transfer between devices

C. To reduce the number of devices needed in the network

D. To allow all devices to communicate freely without restrictions

Solution

1. Step 1: Understand the role of network segmentation

   Network segmentation divides a network into parts to isolate sensitive systems from less secure ones.

2. Step 2: Apply this to IT and OT systems

   Separating IT (office systems) from OT (industrial control) protects critical SCADA systems from cyber threats.

3. Final Answer:

   To improve security by separating critical industrial systems from general IT networks -> Option A

4. Quick Check:

   Network segmentation = Security improvement [OK]

Hint: Segmentation means separation for security, not speed or device count [OK]

Common Mistakes:

• Thinking segmentation speeds up network
• Believing segmentation reduces devices
• Assuming segmentation allows free communication

2. Which of the following VLAN configurations correctly separates IT and OT traffic?

easy

A. VLAN 20 for IT devices, VLAN 10 for OT devices, but no traffic control

B. VLAN 10 for both IT and OT devices without any ACLs

C. VLAN 10 for IT devices, VLAN 20 for OT devices, with ACLs controlling traffic between them

D. No VLANs, all devices on the same network segment

Solution

1. Step 1: Identify VLAN usage for separation

   Using separate VLANs for IT and OT devices isolates their traffic logically.

2. Step 2: Check for access control lists (ACLs)

   ACLs control and restrict traffic between VLANs, enhancing security.

3. Final Answer:

   VLAN 10 for IT devices, VLAN 20 for OT devices, with ACLs controlling traffic between them -> Option C

4. Quick Check:

   Separate VLANs + ACLs = Proper segmentation [OK]

Hint: Separate VLANs plus ACLs control traffic properly [OK]

Common Mistakes:

• Using same VLAN for IT and OT
• Not applying ACLs between VLANs
• Ignoring VLANs and traffic control

3. Given this simplified network ACL rule:
permit ip 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255
What does this rule allow?

medium

A. Allow all IP traffic from 192.168.1.x to 10.0.0.x

B. Block all traffic from 192.168.1.x to 10.0.0.x

C. Allow traffic only from 10.0.0.x to 192.168.1.x

D. Allow traffic from any IP to any IP

Solution

1. Step 1: Understand ACL syntax

   The rule permits IP traffic from source 192.168.1.0/24 to destination 10.0.0.0/24.

2. Step 2: Interpret the wildcard masks

   Wildcard 0.0.0.255 means any IP in the last octet, so 192.168.1.x to 10.0.0.x is allowed.

3. Final Answer:

   Allow all IP traffic from 192.168.1.x to 10.0.0.x -> Option A

4. Quick Check:

   permit ip source to destination = Allow traffic [OK]

Hint: permit ip source wildcard destination wildcard means allow that traffic [OK]

Common Mistakes:

• Confusing source and destination
• Misreading wildcard masks
• Assuming rule blocks traffic

4. You configured VLANs for IT and OT but OT devices cannot communicate with the SCADA server. What is the most likely cause?

medium

A. OT devices have incorrect IP addresses outside VLAN range

B. VLAN IDs for IT and OT are the same

C. SCADA server is powered off

D. Missing or incorrect ACL rules blocking OT to SCADA traffic

Solution

1. Step 1: Check VLAN separation

   If VLAN IDs are different, devices are separated logically, so VLAN ID conflict is unlikely.

2. Step 2: Review ACL rules

   ACLs often block traffic between VLANs; missing or wrong ACLs can prevent OT devices from reaching SCADA server.

3. Final Answer:

   Missing or incorrect ACL rules blocking OT to SCADA traffic -> Option D

4. Quick Check:

   ACL misconfiguration = communication failure [OK]

Hint: Check ACLs first when VLANs separate but no communication [OK]

Common Mistakes:

• Assuming VLAN IDs are same without checking
• Ignoring ACL impact on traffic
• Jumping to hardware power issues first

5. You want to allow only specific IT workstations to access OT SCADA devices. Which approach best achieves this while maintaining network segmentation?

hard

A. Place all IT and OT devices in the same VLAN to simplify access

B. Create a dedicated VLAN for those IT workstations and configure ACLs to allow only their IPs to OT VLAN

C. Disable all ACLs between IT and OT VLANs to allow free communication

D. Use a single firewall rule allowing all IT subnet to access OT subnet

Solution

1. Step 1: Understand segmentation with selective access

   Segmentation requires separate VLANs; selective access needs controlled rules.

2. Step 2: Apply VLAN and ACLs for fine control

   Creating a dedicated VLAN for allowed IT workstations and ACLs restricting access by IP ensures security and selective access.

3. Final Answer:

   Create a dedicated VLAN for those IT workstations and configure ACLs to allow only their IPs to OT VLAN -> Option B

4. Quick Check:

   Dedicated VLAN + ACLs = selective secure access [OK]

Hint: Use VLAN plus ACLs to limit access, not open networks [OK]

Common Mistakes:

• Mixing IT and OT in one VLAN
• Disabling ACLs completely
• Using broad firewall rules without IP filtering