Should the OT network be separated from the office network?
Yes. Most attacks that stop production start in the office network, through e-mail, a stolen password or a supplier's access, and a flat network lets them reach the controllers directly. Separation does not have to mean an air gap. The usual design puts a firewall between office and production, with a small demilitarised zone (DMZ) in between for the systems both sides need, such as a historian copy, a patch server or the remote-access gateway, and with no direct connection from an office PC to a controller. Start by listing the connections production really needs, allow only those and log what is refused. Afterwards, check that the separation holds in practice, because exceptions pile up. From the Pro plan, NetSenX raises an alert when traffic crosses levels of the plant network, for example from an office host straight to a controller, from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port.
Read next
Related questions
- What is the Purdue model, and why does cross-level traffic matter?
- How do I check that our office network cannot reach production controllers?
- Can a ransomware attack on office IT stop a production line?
- How do we control maintenance laptops that connect to our production network?
- Can we see which controllers a visiting technician's laptop talked to?
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.