Blocking an IT-to-OT pivot

A before-and-after view of an IT to OT pivot. Before, a shared domain controller and file server straddle both networks on one unrestricted path. After, two firewalls and an industrial DMZ with a jump host and a read-only replicated historian allow only approved paths and block direct and pivot access from IT to OT.