DMZ

Well how is this that different? It's a layered approach, right? It's the same sort of ideas around, you know, whether it be firewalls and networking security or whatever, we're just now applying that within AI and Gentic environments.

We're creating DMZs, we're creating, you know, call that a sandbox, if you will.

And I think it's just sort of this awakening to, wow, these are practices that we're actually really good at, and now we're going to apply them to agentic use cases.

And I think there's some discovery around that, certainly.

Right.

So you have the Internet connecting to a switch with your public stuff, like your web server, which creates your DMZ, your demilitarized zone.

Exactly.

And then that single firewall sits between the DMZ and your internal private network, just inspecting packets and dropping anything unauthorized.

OK, so that's the baseline.

But I'm guessing bigger companies do something more complex.

Modern environments usually upgrade to a multiple interface firewall.

This is one really powerful appliance that routes traffic between three or more distinct zones.

So part of it can be, you have a static IP, but where is that IP terminated? What device is it coming on? If it's a device that you have enough control over, then it can get pretty interesting.

You can basically use the firewall to forward that to maybe another subnet you set up internally, a DMZ, as we would call it.

That would be a subnet you know is partially exposed to the internet, and maybe we'll treat that a little differently than the rest of your network.

But usually the question we get around this is, I'm going to have more than one website.

So what's the solution there?

According to the CISA intelligence and the international NERC CIP guidelines we're analyzing, the most effective feasible mitigation strategy is the implementation of jump hosts, often referred to as bastion hosts, positioned strictly within a demilitarized zone or DMZ at level 3.5 of the Purdue model.

Let's clearly define what that architecture looks like for you, the operational listener.

Instead of allowing any direct routing or network connection from the enterprise IT network down to the OT plant floor, you position a highly secured, heavily audited server, the jump host, in the DMZ between them.

All traffic must stop there.

Exactly.

Even for the legacy devices?

Yes.

Now place a buffer between plant and enterprise exchanges.

An industrial demilitarized zone, usually called an industrial DMZ, is a separate network zone that hosts selected services between those environments under controlled access rules.

Its job is to contain those exchanges.

A plant-side service might send approved records to a service in the industrial DMZ, while an enterprise service receives those records through a separately permitted connection from its own zone.

Those are distinct connections with distinct permissions.

The enterprise system doesn't inherit access to the filler simply because it can communicate with a service that receives information originating from that machine somewhere deeper in the plant.

A buffer needs enforcement on its boundaries.

Calling a server an industrial DMZ server achieves little if its network interfaces or routing settings still provide an unrestricted route between the plant and enterprise networks around those controls.

We have our different branches that are part of this as well.

We have a DMZ, we have our remote users.

All this is tied in together and we're including pieces as well along the security stack.

Things like Splunk is an example.

They build strict firewall rules that explicitly drop all traffic trying to reach it, except from maybe one single highly secured admin computer.

They wrap it in a demilitarized zone or DMZ, effectively creating a digital airlock.

Okay, so the vulnerability technically still exists on the hard drive, but it is essentially locked inside a vault, buried under a mountain, and guarded by a dragon.

Exactly.

We calculate the exploitability of the weapon, the remediation of the shield, and the confidence of the reporting to find the actual present-day danger.

We unpacked the mechanics of the scanner itself, realizing it is just a script looking for file versions, totally prone to false positives when a patch changes a file path.

We also understand the strategy of documented exceptions, isolating a vulnerable legacy system behind an airlock DMZ because the cost of fixing it outweighs the contained risk.

Right.

I generally give the hit and trial to understand whether it is assigning with something or not.

And sometimes people also create a DMZ.

And there also, with the help of DMZ, they create the entire fake ROS system.

and if someone entered that mac address they can catch up yeah something happened someone has has taken entry in my organization so that that is a different game to bypass dmg to look into the firewall and bypassing the mac address and all So generally, we have to identify, there are multiple ways to identify the MAC address, whether it is proof or not.

But hit and trial is one of the methods.