Segmenting a small water utility without an outage windowA staged approach to Purdue zoning for plants with one operator on nights and no spare PLC.
Defending critical infrastructure
Capabilities
Four ways we work the plant.
OT Cyber ConsultingFractional OT security leadership for operators without a full-time ICS team.DetailsOT Network ArchitectingSegmented control networks designed and built to keep the process running.DetailsOT Cyber AuditA site-level assessment of control system exposure, ranked by consequence.DetailsOT Cyber Program ReviewAn independent review of your OT security program against the standards your regulators cite.Details
Sectors
When the mission can’t fail.
GovernmentMunicipal and state facilities, public works, transit.
DefenseInstallation utilities, shipyards, base infrastructure.
SpaceSatellite ground segments, mission control, launch and range systems.
Water & WastewaterTreatment plants, lift stations, distribution SCADA.
Oil & GasPipelines, compressor stations, terminals.
ElectricSubstations, distribution, generation, DER.
TransportationRail signaling, traffic management, ports and airports.
ManufacturingProduction lines, robotics, batch and process control.
Approach
Defense in depth.
IT security assumes you can patch, scan and reboot. A clarifier drive or a 480 V switchgear controller does not. We work level by level, from the enterprise boundary down to the process, and treat availability as the first control.
PH 1
AssessPassive discovery and architecture review. Findings ranked by consequence.
PH 2
DesignZones and conduits drawn around the process and the outage windows you have.
PH 3
HardenSegmentation built, vendor access closed, configurations locked.
PH 4
SustainProgram review, tabletop exercises and a roadmap your regulator recognizes.
Reference architectureNominal
L5 / L4Enterprise
ERPEmailCorporate AD
ITL3.5Industrial DMZ
Jump hostPatch relayHistorian mirror
BoundaryL3Site operations
HistorianEng. workstationDomain ctrl
OTL2Supervisory
SCADA serverHMIAlarm server
OTL1Control
PLCRTUSafety PLC
OTL0Process
SensorsActuatorsDrives
PhysicalArticles & papers
From the control room.
Why CVSS is the wrong way to rank OT findings
Walking down a lift station network
Meeting TSA SD-02 segmentation with one outage window
