OT/ICS Security for an Industrial Manufacturer

The challenge

A mid-size industrial manufacturer had, over the years, connected its factory networks to management systems to collect production data — with no overall design. PLCs, HMIs and process historians shared the same segments as the offices, and lateral movement from IT could have reached the lines.

The constraint was firm: no unplanned production downtime and no invasive changes to certified controllers. Much of the OT estate tolerated neither active scanning nor agents.

My approach

I rebuilt the OT asset map passively — listening to network traffic rather than probing devices — and classified flows and dependencies across cells, lines and IT systems.

On that basis I defined a zone-and-conduit segmentation aligned to IEC 62443: IT/OT separation, isolated production zones and a controlled intermediate layer for the few legitimate data exchanges.

Roll-out was phased, using maintenance windows already on the calendar. OT monitoring was switched on in listen-only mode before any restrictive rule was applied, validating real flows and avoiding disruption.

The client was left with a living OT inventory, documented segmentation rules and an agreed procedure for safely handling future IT/OT interconnections.