OT cyber-security architecture
Defense architecture and security controls for OT/ICS, from strategy to the switch port.
I design cyber defenses for industrial control systems and critical infrastructure, from the strategy down to implementation. The work starts by mapping every connection into the control network and judging the risk of each one, and continues with a secure architecture and layered controls.
Principles of the defense
- Separate the information network (IT) from the operations network (OT), with a DMZ between them
- Map every connection, cut the exposure, and question whether each link is needed at all
- Layered controls: firewalls, data diodes, intrusion detection and network access control
- Whitelisting, system hardening and patch management
- Behavioural monitoring and anomaly detection in industrial traffic
- An incident-response plan, and a drill to prove it works
Standards
Work follows NIST SP 800-82, NERC CIP and ISA99 / IEC 62443.
Sectors
- Energy and power stations; water, desalination and wastewater
- Gas and oil; chemicals and pharma
- Transport and infrastructure; smart buildings and industry