Project FORTRESS: National Grid Hardening

MISSION REPORT: OPERATION FORTRESS

Target Entity: Power Distribution Network (Regional Utility)
Regulatory Context: NIS2 Directive & National Cyber Perimeter
Risk: License Revocation & Kinetic Sabotage

The Strategic Context

A regional energy provider responsible for powering 2 million homes had grown through rapid M&A. This resulted in a "Frankenstein Network"—a chaotic, flat infrastructure where a malware infection in the HR department's printer could theoretically propagate to the high-voltage substation controllers.

National Cyber Authorities (CSIRT) issued a "Corrective Order" following a failed audit. The Utility had 6 months to overhaul their defense or face license revocation and the removal of the Board of Directors for negligence.

The Intervention: Regulatory Remediation

Intarmour acted as the Regulatory Remediation Task Force. We did not aim for "Best Effort"; we aimed for "Military Standard."

Phase 1: The Purdue Model Implementation We executed a "Scorched Earth" redesign of the network topology. We physically and logically separated the network into strict zones:

• Level 4 (Enterprise): Finance, HR, Email (Internet connected).
• Level 3.5 (DMZ): The Industrial DMZ - the only bridge between worlds, heavily firewalled.
• Level 0-3 (Operations): The Grid Control (Air-Gapped logic). This ensures that a ransomware attack on the office cannot "jump" to the grid.

Phase 2: Supply Chain Purge We audited every vendor with remote access rights. We discovered a maintenance vendor using TeamViewer with a shared password ("Pass1234") to access critical turbines. We terminated the connection immediately. We deployed a Secure Remote Access (SRA) portal requiring biometric Multi-Factor Authentication (MFA) and session recording for all vendors.

Phase 3: The "Golden Power" Cleanup We identified three critical software components in the SCADA network that were sourced from high-risk geopolitical jurisdictions (non-NATO). We managed the migration to sovereign, approved alternatives, aligning the stack with national security standards.

The Operational Outcome

• Audit Success: The regulator re-inspected the facility and passed it with "Commendation" status. The license was renewed for 5 years.
• Resilience Proven: Two months post-project, a commodity ransomware hit the utility's office network (via a phishing email). The office PCs were encrypted, but the Grid operations continued without a flicker. The DMZ firewall held.

Strategic Lesson: Compliance is not just paperwork; it is the blueprint for survival.