Plant & Control Network SecurityMeasure the plant network before anyone sends it a packet.
We start with a passive capture of what your plant network carries and read it against your drawing. Nothing active touches a live controller, HMI or safety system without your written approval. You receive the findings and the order to fix them in.
Commitments
- Before anything is sent to the plant network
- Passive
- Every active step, in writing, by asset and window
- Approved
- Findings in the order to fix them
- Ordered
Sounds like
You might recognize one of these.
Our insurer asked whether the plant is separated from the office, and nobody could say for sure.
An integrator set up remote access during commissioning and we do not know who still has it.
The last time someone scanned the control network, a line went down.
The network drawing is three years old and nobody trusts it.
What you get
Your project deliverables.
- A plain answer to whether the plant network is separated from the office network, and every place the traffic shows it is not
- An inventory of what is on the plant network and what talks to what, from the passive capture
- Your network drawing, marked where the traffic disagrees with it
- Each remote-access path found, with the account behind it where the device configuration names one
- Findings, each with the capture evidence that shows it and what it would let someone do in your plant
- A fix order: what to segment first, and what can wait
- Free retest of remediated findings within the engagement window
What this includes
What the scope includes.
Not every engagement needs all of it. This is the range we cover and what each part is actually for.
Passive capture first
A record of what the plant network actually carries, collected without sending anything to it. Active scanning has knocked production offline, and a twelve-year-old controller may not survive it.
The drawing, checked against the traffic
Four places we check the drawing against the traffic: a VLAN that is not a boundary, a dual-homed machine bridging the firewall, a remote-access path nobody recorded, and changes made since commissioning.
Remote access, as its own question
Who can reach the plant from outside, by which path, with which account. Named accounts per vendor engineer and access that expires are the usual fix, and each finding says which applies.
Segmentation before detection
The order we argue for: an accurate inventory, then segmentation, then monitoring. A monitored flat network tells you an attack is spreading; a segmented one limits how far it gets.
Active testing only with approval
Nothing active touches a live controller, HMI or safety system without written approval naming the asset and the window. Where a test would be unsafe on production, it runs against a spare or not at all.
Industrial anomaly research
Our published ICS work is bench research on a multi-vendor PLC bench and public labeled captures, not a live plant, and we say so before you scope anything.
Tooling
Tools used for this work.
No tool here was picked because it was new. Where we do reach for something novel, it is in one place, for a stated reason, and it is written down.
- Capture and analysis
- Control systems
- Guidance
Questions
Common questions.
Not to start. The first step is a passive capture, which sends nothing to the plant network. Anything active needs your written approval naming the asset and the window, and a test that would be unsafe on production runs on a spare or not at all.
Our published ICS work is bench research: a multi-vendor PLC bench and public labeled captures, under a federally funded research program, peer-reviewed at IEEE CARS 2024. We say so before you scope anything. The passive capture is the step that sends nothing to your plant, so it is where the work starts.
Anomaly Detection in ICS Networks with Fuzzy Hashing (opens in a new tab), IEEE Cyber Awareness and Research Symposium (CARS) 2024
Your network owner or integrator configures the mirror port or tap, and we say which switch and which port. A change on a live switch is an active step, so it needs the same written approval as any other. The capture is your data: it is used only for the engagement, then returned and certified destroyed to NIST SP 800-88.
Your network drawing if there is one, a mirror port or tap that your network owner or integrator configures, a contact at that integrator, and a list of the sites and segments in scope, which is what the price is set on. For the remote-access paths, the firewall and remote-access gateway configurations if you can share them, since a capture shows the path but not the account behind it. Anything active also needs a written approval naming the asset and the window.
It is evidence for parts of them, not an audit against any. The inventory and the marked-up drawing are where an IEC 62443 zone and conduit model starts, and the same record of what talks to what feeds the part of an AWIA risk and resilience assessment that covers your electronic and automated systems. It is not a NERC CIP compliance audit, and we certify against none of the three.
Yes, if there is one. It is the statement of intent the traffic is checked against. If there is no drawing, the capture becomes the first one.
The price is agreed with the scope before the work starts, and it depends on how many sites and network segments there are. The external assessment is our one published fixed price, and it reads your public surface, not your plant.
Your team, your integrator or us. A finding in a controller our hardware division programmed goes back to them, and we re-test the fix. Segmentation and remote-access changes usually belong to whoever owns the network, and we re-test those too.
Often paired with
Sources
- 1.SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security (opens in a new tab), NIST
- 2.Anomaly Detection in ICS Networks with Fuzzy Hashing (opens in a new tab), IEEE Cyber Awareness and Research Symposium (CARS) 2024,
Next step
Tell us what’s breaking.
Forty-five minutes, no charge, no deck. We’ll tell you what we’d do, what it would likely cost, and whether the thing you’re worried about is actually your biggest risk.
- Phone
- (214) 723-2510
- Reply
- A person replies, not a sequence: within one business day, from someone who would be on the engagement.