Cybersecurity
The first 24 hours of a cyber incident: what to do, and what not to
Decisions made in the first hours of an incident decide how much is lost, how long recovery takes and whether you can later explain what happened.
Cybersecurity
OT security in ports and plants starts with knowing what is on the network
You cannot protect a controller you do not know exists. In most industrial sites, the first useful project is an accurate inventory, collected without disturbing operations.
Operational technology, the controllers, sensors and control systems that run cranes, pumps, kilns and pipelines, was designed to be reliable, not secure. Many of these systems now connect to corporate networks, vendors' support links and cloud dashboards. Attacks on industrial sites around the world have shown what that connection can cost.
Why inventory comes first
Industrial networks often hold equipment installed over decades by different contractors. Drawings are out of date, and some devices are known only to the engineer who installed them. Before you can segment, patch or monitor, you need to know which devices exist, what firmware they run and what they talk to.
Collect it passively
Active scanning tools built for office networks can disrupt older controllers. Passive monitoring, which listens to a copy of network traffic, can identify devices, protocols and communication paths without sending anything to the equipment. Combine it with site walk-downs and the engineering team's knowledge.
Zones and conduits
The IEC 62443 series of standards describes grouping assets into zones with similar security needs and controlling the conduits between them. In practice, that often follows the levels of the Purdue model: field devices, control, supervisory systems, site operations, and the corporate network, with a demilitarised zone between operations and IT so that no traffic passes straight through.
Remote access
Vendor remote access is one of the most common ways into industrial networks. Replace always-on connections with a single controlled gateway that requires multi-factor authentication, is opened only when needed and records each session.
Plan for recovery
Keep offline backups of controller programs and configurations, and test that they can be restored. Agree with operations who can decide to isolate a network during an incident, because in a plant, safety and production come first.
Test carefully
Security testing in OT should be planned with the engineers, run against test systems or during maintenance windows where possible, and avoid anything that could change a process.
Our team works with port operators, utilities and manufacturers on OT asset discovery, segmentation, remote access and monitoring, with engineers who understand both control systems and security.
