Unit 9: Firewalls and segmentation · Lesson 6 of 6 · 20 min
Case file: when office IT can stop the factory
Read zone rules between office IT and the plant, find the rule that ties them together and design a conduit through a DMZ.
case file
Jaguar Land Rover Production Shutdown
Jaguar Land Rover · 2025
Jaguar Land Rover shut down its network on August 31, 2025 after detecting attackers, halting vehicle production for several weeks; a group calling itself Scattered Lapsus$ Hunters claimed responsibility and JLR later confirmed data was taken. On September 29, 2025, the UK government approved a GBP 1.5 billion loan guarantee to support JLR and its supply chain, which employs about 120,000 people. JLR reported the incident cost GBP 196 million in its July-September quarter and restarted production in phases from early October.
What went wrong
Not publicly confirmed (uncertain). The documented lesson is resilience: tightly coupled IT and manufacturing systems meant a containment shutdown stopped production and cascaded to suppliers.
What would have stopped it
- Segment manufacturing/OT systems from corporate IT so containment of an IT intrusion does not require stopping production.
- Maintain tested recovery plans and immutable backups with realistic restore-time objectives for production-critical systems.
- Assess supplier dependency and financial resilience as part of business continuity planning.
- Harden help desk and identity processes against social engineering, a known tactic of the claiming group (uncertain whether used here).
What defenders could have seen
- Unexpected privileged account activity or new remote access tooling in corporate IT.
- Alerts on mass access to file shares or data staging prior to exfiltration.
mission
- You are
- The network architect for corp.example's manufacturing site.
- Situation
- The plant's controllers and manufacturing execution system sit in
plant-ot. The firewall zone rules are in~/firewall/zones.csv. This lab is modelled on the Jaguar Land Rover shutdown, where the attack's entry point is not public but containment stopped production for weeks. - Goal
- Find every path that lets office IT reach production systems directly and propose the replacement.
- Hand in
- The rules to remove and the conduit to add.
Bulkheads between office and plant
Read the zone rules
Rules are numbered. Read every pair of zones in both directions.
cat zones.csv
rule,src_zone,dst_zone,service,verdict
1,internet,plant-dmz,any,deny
2,corp-it,plant-dmz,tcp 443,allow
3,plant-dmz,plant-ot,tcp 502,allow
4,corp-it,plant-ot,any,allow
5,plant-ot,corp-it,any,allow
6,plant-ot,internet,any,deny
7,corp-it,internet,tcp 443,allow
you should see A DMZ exists, but rules 4 and 5 bypass it in both directions.
Isolate the risky rule
Filter for office IT talking straight to the plant.
awk -F, '$2=="corp-it" && $3=="plant-ot"' zones.csv
4,corp-it,plant-ot,any,allow
you should see Any service from any office machine to any plant machine.
List what stops production
These are the systems that must keep running even when the office network is shut down.
grep ',yes$' plant-assets.csv | cut -d, -f1,3
mes01,manufacturing execution
plc-line1,line 1 controller
plc-line2,line 2 controller
you should see Three systems: the manufacturing execution system and two line controllers.
defender tip If containing an IT incident means pulling the plug on IT, the plant must be able to run on its own. Test that.
Between office and plant
4 corp-it -> plant-ot any allow 5 plant-ot -> corp-it any allow
One compromise spans both; containing it stops production.
corp-it -> plant-dmz tcp 443 allow plant-dmz -> plant-ot named services allow corp-it -> plant-ot drop, log
The plant can keep running while IT is isolated.
List every way into the plant
Filter on the destination zone to see every path into production.
awk -F, '$3=="plant-ot"' zones.csv
3,plant-dmz,plant-ot,tcp 502,allow
4,corp-it,plant-ot,any,allow
you should see Only the DMZ rule is narrow: Modbus on tcp 502. The office rule allows everything.
What a defender takes away
- 1Production systems should never depend on direct paths from office IT.
- 2Use a plant DMZ as the only meeting point.
- 3Plan and rehearse running production with IT disconnected.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.