A manufacturing company is implementing a Zero Trust strategy for its operational technology (OT) environment, which includes industrial control systems (ICS). Due to the sensitivity and proprietary nature of these systems, direct internet access is strictly prohibited. However, the security team needs to collect telemetry and security logs from these isolated OT systems for centralized monitoring and threat detection in Microsoft Sentinel. Which architectural pattern should be used to securely bridge the air-gapped OT network to Azure while adhering to Zero Trust principles?
- ADirect Internet Breakout
- BJump Server with Data Diode
- CVPN Gateway with Full Tunnel
- DAzure ExpressRoute with Public Peering
Show answer & explanationAnswer & explanation
Correct answer: B. Jump Server with Data Diode
For highly isolated (air-gapped) environments like OT, a Jump Server combined with a Data Diode (or other unidirectional communication mechanism) provides a secure, one-way data transfer path. The Jump Server acts as a hardened intermediary, and the data diode ensures that data can only flow out of the OT network, preventing any inbound connections or commands, thus maintaining isolation while enabling telemetry collection for Sentinel.
Why the other options are wrong
- A. Direct Internet Breakout violates the 'strictly prohibited direct internet access' requirement for OT environments.
- C. A VPN Gateway with Full Tunnel provides bidirectional network connectivity, which introduces inbound risk and violates the strict isolation requirements for an air-gapped OT environment.
- D. Azure ExpressRoute with Public Peering provides direct connectivity to Azure public services but does not inherently provide unidirectional data flow or the stringent air-gap security required for OT.
Jump Server with Data Diode (OT Zero Trust)
An architectural pattern for securely connecting highly isolated (air-gapped) environments, like Operational Technology (OT) networks, to external systems. A hardened jump server facilitates controlled access, and a data diode ensures strictly unidirectional data flow, allowing telemetry to be extracted without enabling inbound connections or commands.
- Connects air-gapped networks securely
- Jump server for controlled access
- Data diode for unidirectional data flow
- Prevents inbound connections to OT
Memory trick: The 'jump' is one-way, through a 'diode' for rock-solid security.