A smart factory is implementing a new generation of industrial robots that are interconnected and communicate over a wireless mesh network. Each robot controller uses a unique digital certificate for authentication and encryption. To further enhance the security posture against a compromised individual robot, the security architect proposes a measure that ensures if one robot is compromised, it cannot easily spread malware or control commands to others in the network. Which of the following countermeasures best fits this description?
- AEnforcing strong password policies for robot maintenance accounts.
- BImplementing a centralized firmware update server.
- CDeploying intrusion detection systems (IDS) on the network edge.
- DApplying micro-segmentation to isolate individual robot communications.
Show answer & explanationAnswer & explanation
Correct answer: D. Applying micro-segmentation to isolate individual robot communications.
Micro-segmentation isolates individual workloads (in this case, individual robot controllers) from each other, even within the same network segment. If one robot is compromised, micro-segmentation limits its ability to communicate directly with and spread to other robots, thus containing the breach. While digital certificates provide authentication, micro-segmentation provides network-level isolation.
Why the other options are wrong
- A. Strong password policies protect maintenance accounts but don't address network lateral movement once a device is compromised.
- B. Centralized firmware updates are important for patching but don't prevent lateral movement after a compromise.
- C. IDS at the network edge monitors external threats but is less effective at containing lateral movement *within* an already compromised internal mesh network.
OT Micro-segmentation
A network security technique that divides a network into small, isolated segments down to the individual workload level, applying granular security policies to each segment.
- Limits lateral movement of threats within a network.
- Reduces the attack surface for each individual device.
- Enhances containment by isolating compromised systems.
Memory trick: Micro-segmentation fences off each robot, stopping malware's 'spread'.