A utility distinguishes between a 'Guest' access tier for unmanaged, walk-in visitors and a 'Contractor' group for vetted third parties with an ongoing work order. Why does this distinction matter for how firewall policies are written?
Select an answer to reveal the explanation.
Short Explanation
A walk-in visitor and a vetted contractor with a signed work order aren't the same risk, so treating them the same in a policy would either over-trust the visitor or under-serve the contractor. Guests usually just need internet access behind a disclaimer, while contractors need a scoped path to whatever system their work order actually covers. Separate groups let each get exactly what they need and nothing more.
Full Explanation
Distinguishing Guest and Contractor populations lets a utility write firewall policies that match each group's actual trust level and operational need — guests, being unvetted and often present for only minutes or hours, typically warrant a narrow disclaimer-gated policy limited to general internet access, while contractors, who have been vetted and have a defined work order, warrant scoped access to specific systems (such as a particular substation segment) for the duration of that work order. Collapsing both into one group either over-grants access to unvetted walk-ins or under-serves contractors who need more than internet-only reach, so treating them identically for administrative convenience defeats the purpose of having groups at all. There is no general principle that guests deserve broader access than contractors — if anything the reverse is typically true, since contractors have been vetted for a specific purpose and guests have not. Contractors do need to authenticate; the presence of a work order does not exempt them from firewall authentication, it just means their assigned group and policy differ from a guest's. The caveat here is administrative: as work orders end, contractor accounts and group membership need timely review just as guest accounts need expiration, so the distinction only pays off if lifecycle management for both groups is maintained. Confirm the separation is meaningful by comparing what each group's policy actually permits.