Microsoft Cybersecurity Architect (SC-100)Design a Zero Trust strategy and architectureHard
A manufacturing company is implementing a Zero Trust strategy for its Operational Technology (OT) network, which controls critical machinery. Due to the sensitive nature of OT systems, direct internet connectivity and complex software installations are strictly prohibited. The company needs to provide secure, audited, and isolated remote access for maintenance personnel to specific OT devices without introducing new attack vectors from the IT network. Which solution BEST aligns with these stringent requirements?
- AImplementing a jump server (bastion host) with a data diode between IT and OT networks.
- BExtending the corporate Azure AD to directly authenticate users on OT devices.
- CDeploying a traditional VPN server within the OT network.
- DInstalling endpoint detection and response (EDR) agents on all OT devices.
Show answer & explanationAnswer & explanation
Correct answer: A. Implementing a jump server (bastion host) with a data diode between IT and OT networks.
A jump server (bastion host) provides a controlled and monitored access point, and a data diode enforces one-way communication, preventing data exfiltration from the OT network while allowing commands in. This combination offers highly isolated, secure, and audited access, minimizing attack surface and aligning with the 'Assume Breach' and 'Least Privilege' principles crucial for OT Zero Trust.
Why the other options are wrong
- B. Directly extending Azure AD to OT devices introduces modern authentication complexities and potential dependencies on IT infrastructure that are often avoided in isolated OT environments.
- C. A traditional VPN introduces a direct, bidirectional network connection, which is often considered too risky for highly sensitive OT environments due to potential attack vectors.
- D. Installing EDR agents on OT devices can introduce compatibility issues, performance impacts, and potential attack surfaces on systems not designed for such software, and it doesn't solve the secure remote access problem.
Jump Server with Data Diode (OT Zero Trust)
A secure access pattern for Operational Technology (OT) networks using a hardened intermediary server (jump server) combined with a data diode for unidirectional data flow.
- Jump server acts as a controlled access point.
- Data diode enforces one-way communication (e.g., IT to OT only).
- Provides air-gapped security benefits with controlled remote access.
Memory trick: Jump through the Diode to reach the OT safe zone.