In zone-based OT network risk assessment, what is the recommended practice?

In zone-based OT network risk assessment, what is the recommended practice?

• A. Focus only on OT
• B. Use a single global risk score
• C. Ignore inter-zone traffic
• D. Map zones (IT/DMZ/OT), identify assets and controls in each zone, assess inter-zone traffic, evaluate vulnerabilities, and prioritize mitigations by zone risk

Answer: (D)

Take a zone-based approach to risk in OT networks: map IT, DMZ, and OT zones; inventory assets and controls in each zone; assess how traffic moves between zones; evaluate vulnerabilities; and prioritize mitigations by zone risk. This method mirrors how real networks are structured, so you understand not just what exists in a single place but how different parts of the system interact and where the biggest hazards lie. Why this works best: segmentation matters. Different zones have different assets, controls, and exposure. OT typically harbors critical, time-sensitive processes; IT handles data and services; the DMZ sits at the boundary. By examining inter-zone traffic, you can see how an issue in one zone could affect another, identifying cross-zone risks that a single-zone view would miss. Prioritizing mitigations by zone risk helps allocate resources where they have the most impact, strengthens defense-in-depth, and supports targeted monitoring and response. Focusing only on OT misses other crucial risks in IT and the DMZ. Using a single global risk score hides differences between zones and can mislead where to apply protections. Ignoring inter-zone traffic overlooks potential paths attackers could exploit to move between zones or to reach OT assets, leaving gaps in protection.

Take a zone-based approach to risk in OT networks: map IT, DMZ, and OT zones; inventory assets and controls in each zone; assess how traffic moves between zones; evaluate vulnerabilities; and prioritize mitigations by zone risk. This method mirrors how real networks are structured, so you understand not just what exists in a single place but how different parts of the system interact and where the biggest hazards lie.

Why this works best: segmentation matters. Different zones have different assets, controls, and exposure. OT typically harbors critical, time-sensitive processes; IT handles data and services; the DMZ sits at the boundary. By examining inter-zone traffic, you can see how an issue in one zone could affect another, identifying cross-zone risks that a single-zone view would miss. Prioritizing mitigations by zone risk helps allocate resources where they have the most impact, strengthens defense-in-depth, and supports targeted monitoring and response.

Focusing only on OT misses other crucial risks in IT and the DMZ. Using a single global risk score hides differences between zones and can mislead where to apply protections. Ignoring inter-zone traffic overlooks potential paths attackers could exploit to move between zones or to reach OT assets, leaving gaps in protection.