What measures are recommended to secure industrial protocol traffic such as Modbus and DNP3 between IT and OT networks?

What measures are recommended to secure industrial protocol traffic such as Modbus and DNP3 between IT and OT networks?

• A. Rely on antivirus
• B. Network segmentation, restrict to necessary commands, monitor anomalies, and apply application-layer filtering with robust authentication
• C. Allow all commands and disable monitoring
• D. Use VPN without segmentation

Answer: (B)

Industrial protocol traffic from IT to OT networks needs layered controls because protocols like Modbus and DNP3 were not designed with strong security in mind. The recommended approach combines several protective measures at the IT/OT boundary: network segmentation to limit how far traffic can travel if something is compromised; restricting commands to only what is necessary so even approved traffic can’t perform risky actions; monitoring for anomalies to detect unusual or unauthorized activity; and applying application-layer filtering with robust authentication to verify who and what can send and execute specific protocol commands. Segmentation reduces the blast radius by isolating OT assets from broad IT access. Restricting commands implements the principle of least privilege so devices can only perform intended actions. Monitoring catches deviations from normal behavior, which helps identify attempts to misuse the protocol. Application-layer filtering goes beyond simple port blocking by inspecting the actual protocol messages and enforcing authentic, approved interactions, making it harder for attackers to disguise unauthorized activity. Strong authentication ensures that devices and users are who they claim to be, preventing impersonation. Other options don’t provide the same depth of protection. Relying on antivirus isn’t sufficient for OT protocols, which may run on devices that don’t support antivirus or aren’t protected by it. Allowing all commands and turning off monitoring creates obvious vulnerabilities. Using a VPN without segmentation leaves the OT network exposed and doesn’t enforce command-level controls or protocol-level inspection.

Industrial protocol traffic from IT to OT networks needs layered controls because protocols like Modbus and DNP3 were not designed with strong security in mind. The recommended approach combines several protective measures at the IT/OT boundary: network segmentation to limit how far traffic can travel if something is compromised; restricting commands to only what is necessary so even approved traffic can’t perform risky actions; monitoring for anomalies to detect unusual or unauthorized activity; and applying application-layer filtering with robust authentication to verify who and what can send and execute specific protocol commands.

Segmentation reduces the blast radius by isolating OT assets from broad IT access. Restricting commands implements the principle of least privilege so devices can only perform intended actions. Monitoring catches deviations from normal behavior, which helps identify attempts to misuse the protocol. Application-layer filtering goes beyond simple port blocking by inspecting the actual protocol messages and enforcing authentic, approved interactions, making it harder for attackers to disguise unauthorized activity. Strong authentication ensures that devices and users are who they claim to be, preventing impersonation.

Other options don’t provide the same depth of protection. Relying on antivirus isn’t sufficient for OT protocols, which may run on devices that don’t support antivirus or aren’t protected by it. Allowing all commands and turning off monitoring creates obvious vulnerabilities. Using a VPN without segmentation leaves the OT network exposed and doesn’t enforce command-level controls or protocol-level inspection.