OT protection project
We address the risks identified in the assessment: we install network and endpoint OT protection tools at the critical points, on a schedule that does not disrupt production.
Network and endpoint
What we put in place at the critical points
Our designs are vendor-independent and fit the equipment you already have. For OT-specific protection we work with TXOne devices, and on the network side with Fortinet solutions.
Virtual patching in front of devices that cannot be updated
An industrial IPS installed inline in the network recognizes and blocks traffic aimed at the vulnerability, while the device itself stays untouched. Exploitation can be prevented even if the vendor will not ship a fix for years.
Rules at the industrial protocol level
A general-purpose firewall sees Modbus traffic as a single port. An OT-aware device also sees the function code, so you can require that the PLCs in a segment are read-only, with writes allowed only from the engineering workstation.
Allowlisting on the endpoints
On HMIs and engineering workstations only the applications on a fixed list can run, and everything else is blocked by default. It needs no daily updates, and it also protects against unknown malware.
Portable scanning (TXOne Portable Inspector)
Some machines cannot have anything installed on them. In that case the engineer plugs in a USB device, runs the check, and moves on to the next machine. Nothing is installed on the machine, and no process is left running on it.
The process
From plan to handover
A mistake on the plant floor costs far more than one in the office, so the protection goes live step by step, with checks along the way.
-
Implementation plan
We use the assessment results to pick the critical points, and we schedule the installation around the production schedule.
-
Installation in monitor mode
At first the devices only watch and learn: they record what actually runs on the machines and what passes through the network. If a spare device with the same configuration is available, we validate the installation on it first.
-
Enforcement
Once the learned baseline has been checked, we switch to blocking mode. Every active step is agreed with you in advance and comes with a rollback plan.
-
Joint training
The operations and IT teams learn together how to manage the protection. The training gives the two teams a shared language, and IEC 62443 helps here, since plant engineers and IT staff both understand it.
-
Acceptance and handover
A final test confirms that the protection works as planned and production runs undisturbed. Then we hand over the documentation.
Deliverables
What you get at the end
items handed over
- Detailed implementation plan and schedule
- Installed and configured OT protection devices
- Joint training for the operations and IT teams
- Final acceptance test and documentation
Related services
Before, alongside, after
The protection project is one step in a larger body of OT security work. These services build on it or complement it.
OT security assessment
Shows what is on the OT network and what talks to what. The protection project starts from the risks and priorities it identifies.
OT network segmentation
Splitting a flat network into zones. The zone boundaries are the points where the network protection goes.
OT endpoint protection
Protection for old HMIs, engineering workstations, and industrial PCs that cannot be updated or are cut off from the internet, without slowing operations down.
OT protection platform maintenance
Keeping the installed protection devices up to date after handover.
Frequently asked questions
The questions we hear most
Do we need an assessment before the protection project?
Yes. Without an asset inventory there is no way to know what needs to be installed where. If the only goal is to protect old endpoints, the standalone OT endpoint protection service can start without an assessment. We explain why everything starts with the inventory in our article on securing ICS/SCADA systems.
Does production have to stop?
Most of the work needs no downtime. Where installing a device does require it, we agree on a short maintenance window that fits your existing maintenance schedule.
What will the equipment manufacturer say?
This has to be clarified in advance for every piece of equipment. Many suppliers prohibit installing third-party software and void the warranty or certification if you do. On the other hand, many manufacturers now support, and even recommend, OT-specific protection tools. For how OT endpoint protection differs from IT tools, see our article on OT endpoint protection.
Who maintains the protection after handover?
The protection needs maintenance: when the equipment supplier updates the control software, the allowlist has to be updated too. We can take this on as part of OT protection platform maintenance, under a custom agreement and within a scope agreed with you. The maintenance does not include alert monitoring.
