At a glance
- Client
- A process manufacturing companyName withheld for confidentiality
- Industry
- Manufacturing
- Service
- Cybersecurity
- Scope
- OT security assessment, segmentation and endpoint protection
The challenge
The plant's control systems were cut off from the internet, so they were assumed to be safe. In practice, engineers moved files on USB drives, contractors plugged in laptops, and nobody could see what happened on the plant network.
Many control computers ran old operating systems that could not simply be patched or taken offline.
Our approach
Map the plant network
We passively discovered every controller, workstation and connection without disturbing production.
Segment OT from IT
Zones and conduits separate control systems from business networks, with unidirectional gateways for data leaving the plant.
Control removable media
USB use goes through scanning kiosks, and endpoint protection locks down control workstations.
Watch for anomalies
OT-aware monitoring alerts on unusual commands or new devices.
The solution
Production data still reaches business systems, but nothing can flow back into the control network. Removable media is scanned before use, and unexpected activity on the plant floor is spotted quickly.
All of this was delivered around production schedules, with no unplanned downtime.
Results
- Full inventory of OT assets and connections
- One-way gateways between plant and business networks
- USB scanning kiosks and locked-down workstations
- Continuous OT-aware threat monitoring
Technology used
- IEC 62443
- Unidirectional security gateways
- OT network monitoring
- Application allow-listing
Facing a similar challenge?
Tell us what you are working on. We will walk you through how we would approach it, with no obligation.