The challenge
The plant’s PLCs, HMIs and engineering laptops share one flat network with office PCs and the guest Wi-Fi. A vendor’s remote-access tool on one HMI is permanently online. Nobody chose this design; it grew.
Head office now wants live production and energy dashboards from the line. The quick way, opening ports so a reporting server can poll the PLCs directly, would connect the control layer to the corporate network and, through it, the internet.
Ransomware that crosses from IT into OT doesn’t just encrypt files; it stops production. The control engineers are right to push back.
Our approach
-
Asset and traffic audit
We identify every device on the network and passively record which devices talk to which, so the new design is based on real traffic rather than old drawings.
-
Zones and conduits
Following IEC 62443 and the Purdue model, the network is split into a control zone (PLCs and HMIs), a supervisory zone (SCADA) and an industrial DMZ, separated by industrial firewalls that allow only the specific traffic each zone needs.
-
Read-only data path
A data concentrator in the supervisory zone reads the PLCs and publishes the values outward to the DMZ. Reporting tools read the DMZ copy, and nothing in the business network can write to, or even reach, a PLC.
-
Controlled remote access
The always-on vendor tool is removed. Remote support goes through a jump host in the DMZ with named accounts, time-limited sessions and logging.
System architecture
How the layers connect, from the people using the system down to the equipment in the field.
- ERP and head-office reporting
- Production and energy dashboards
- Replicated plant data
- Jump host for vendor access
- No direct path from business to control
- SCADA and historian
- RTU data concentrator
- PLCs, HMIs and drives
- Reachable from level 3 only
- Sensors, actuators and motors
What we’d deploy
- Passive asset discovery and a traffic baseline
- Industrial firewalls between every zone, with default-deny rules
- RTU data concentrator reading PLCs read-only
- Industrial DMZ holding replicated data for business systems
- Jump-host remote access with named accounts and session logs
- An incident response plan written with the plant team
Target outcomes
Targets we would design and report against, not measured results from a named client. Actual results depend on the baseline established in the audit.
