Segment without stopping the line
Make four access decisions and test whether your policy preserves required operations.
By Abdul Khadir Mahamed · Updated 3 November 2026
Independent guided exercise using synthetic evidence. No live industrial systems are connected.
Your scenario
A vendor is supporting a packaging cell. Define explicit flows for operations and maintenance.
Evidence to examine
HMI → PLC / TCP 502 / required process reads Jump host → Engineering workstation / TCP 3389 / approved maintenance Vendor laptop → PLC / TCP 502 / no direct access approved PLC → Internet / TCP 443 / no business requirement
Your investigation tasks
- Open the Architecture Studio below the lab library.
- Set allow or deny for each flow.
- Validate the policy and review any operational or access failures.
Debrief
Review the reasoning after completing the tasks
Allow HMI → PLC and jump host → engineering workstation. Deny direct vendor → PLC and PLC → internet. In a real deployment, also constrain direction, source identity, destination, time windows, and change approval.
Take it back to the process
Separate observed facts from assumptions. Explain the operational consequence of your decision, name the evidence still needed, and identify who must approve or validate a real-world change.