What is the function of a DMZ in a utility network from a defense perspective?

What is the function of a DMZ in a utility network from a defense perspective?

• A. DMZ hosts exposed services and acts as a buffer between IT and OT networks, including jump hosts and industrial gateways
• B. DMZ stores PLC firmware offline
• C. DMZ is the same as the OT network
• D. DMZ should be completely disconnected from both IT and OT

Answer: (A)

A DMZ in a utility network functions as a buffer layer between IT and OT, hosting only the exposed services that need to be reachable from less trusted networks. By placing jump hosts and industrial gateways in this zone, you create a controlled point where external or IT-originating access is inspected and authenticated before any traffic can reach the OT network. This containment means that if an IT-facing service is compromised, the reach into OT devices like PLCs is limited and monitored, reducing the chance of lateral movement and helping with logging and visibility. Storing PLC firmware offline isn’t about the DMZ’s role; the DMZ’s purpose is not data storage but network segregation and controlled access. The DMZ is not the same as the OT network; it’s purpose-built to sit between IT and OT with strict policies. And it shouldn’t be completely disconnected from both sides; instead, it provides controlled, auditable pathways for necessary communications, while keeping OT protected behind layered defenses.

A DMZ in a utility network functions as a buffer layer between IT and OT, hosting only the exposed services that need to be reachable from less trusted networks. By placing jump hosts and industrial gateways in this zone, you create a controlled point where external or IT-originating access is inspected and authenticated before any traffic can reach the OT network. This containment means that if an IT-facing service is compromised, the reach into OT devices like PLCs is limited and monitored, reducing the chance of lateral movement and helping with logging and visibility.

Storing PLC firmware offline isn’t about the DMZ’s role; the DMZ’s purpose is not data storage but network segregation and controlled access. The DMZ is not the same as the OT network; it’s purpose-built to sit between IT and OT with strict policies. And it shouldn’t be completely disconnected from both sides; instead, it provides controlled, auditable pathways for necessary communications, while keeping OT protected behind layered defenses.