A regional water utility is planning a hybrid architecture that keeps its industrial control system network for pumping stations on-premises while migrating corporate email, finance, and customer billing to a public cloud provider. The two environments will be joined by a site-to-site VPN and a shared identity provider. The security architect must explain to executives which design decision most directly addresses the distinctive risk that this hybrid arrangement introduces, given that the on-premises segment hosts legacy ICS and SCADA equipment with long patch cycles and limited authentication capability. Which design choice best mitigates the dominant hybrid risk in this scenario?
- APlace a tightly controlled industrial demilitarised zone with unidirectional or strictly filtered gateways between the on-premises ICS network and the routes that reach the cloud-hosted corporate services, so that traffic into the control network is constrained to known protocols, sources, and destinations. Correct
- BExtend the corporate Active Directory trust into the ICS network so that engineers can use the same cloud-federated credentials on pumping station historians, reducing password reuse and simplifying joiner-mover-leaver processes for plant staff.
- CMove the SCADA historian database into the public cloud alongside the billing system so that the utility benefits from the cloud provider's patching, redundancy, and managed database hardening for all process data going forward.
- DReplace the site-to-site VPN with direct public internet exposure of the ICS management interfaces protected only by strong passwords and multifactor authentication, since modern authentication compensates for the lack of network controls in front of plant equipment.
Why A is correct: Hybrid architectures concentrate risk at the seam where corporate and cloud zones meet the brittle ICS estate; an industrial DMZ with unidirectional or tightly filtered gateways enforces ISA/IEC 62443 zone separation and stops cloud or corporate compromise from pivoting onto pumping station controllers.
Why B is wrong: Pushing federated corporate identity directly onto fragile ICS hosts widens the blast radius of any cloud or corporate credential compromise into the operational technology zone; this is the opposite of what the Purdue-style separation between IT and OT calls for.
Why C is wrong: Relocating the historian to the cloud and exposing it to internet-reachable services raises confidentiality, integrity, and availability risk for safety-relevant process data, and many regulators explicitly require process data to remain within the operational technology boundary.
Why D is wrong: Publishing ICS management interfaces to the internet is precisely the exposure pattern that Shodan-style scans and prior ICS incidents have shown to be catastrophic; authentication alone cannot compensate for missing perimeter and segmentation controls in front of legacy controllers.