Malware-protection layers

A file path from untrusted sources (USB drive, optical media, vendor email, internet download) through an isolated multi-engine scanning and quarantine zone, an IDMZ file transfer server and update repository, and a firewall to an engineering workstation that runs only allowlisted applications and on to a PLC, with suspect files kept in quarantine.