OT Security Assessments, Segmentation Validation, and Incident Readiness
Protect the Valves, Pumps and Breakers Behind Essential Services
An intruder on the business network steals data, but one who reaches a controller can open a valve, stop a pump or trip a breaker. Global Digital Forensics shows utilities, water systems, energy operators and manufacturers which remote access paths, vendor connections and flat networks could carry an attacker from the office to the control room. We work passive first, inside windows your engineers approve, and rank every finding by what it would do to the process.
Where plants are exposed
Assessment Boundaries Drawn by the People Who Run the Plant
The exposure an operator carries is rarely exotic. It is a vendor remote access path nobody decommissioned after commissioning, a flat network between the business side and the control room, or a shared credential on a controller older than the current staff. Finding those conditions without disturbing the process starts with authority: your operations and engineering leads approve the systems we touch, the safety limits, the test windows and the person who can say stop, and we write those decisions into the rules of engagement before any work begins.
Vendor and Remote Access
Integrator VPNs, support portals, jump hosts and cellular modems, traced from the outside connection to the engineering functions each one can reach.
Office to Control Room Boundaries
Firewall rules, dual homed hosts, historian links and shared directory services that decide whether the business network can talk to supervisory systems.
Controllers and Engineering Stations
Default and shared credentials, unprotected project files and programming access that would let one compromised laptop change the logic running the process.
Built for the operators of essential services
- Utilities and public authorities
- Water and wastewater operators
- Power and energy operators
- Ports and transportation operators
- Municipalities
- Electric cooperatives
Engagements
Six Industrial Engagements, Scoped to the Question You Face
Not sure which fits your sites? A senior OT specialist will recommend the starting point on the first call.
-
OT, ICS and SCADA Assessment
A plant wide view of assets, access paths and exposures, ranked by the process at risk so scarce maintenance windows go where they matter. OT, ICS and SCADA security assessments
-
SCADA Security Testing
HMIs, historians, engineering workstations and vendor sessions tested for who can actually see and change the process. SCADA security testing
-
Segmentation Validation
The boundary between business and control networks tested against the drawing, rule by rule and path by path. Network segmentation validation
-
Incident Response Readiness
A realistic scenario run with the operators who would execute the plan, before an event exposes its gaps. OT, ICS and SCADA incident response
-
NERC CIP Technical Evidence
Technical gaps identified and evidence organized by requirement, in the form a Regional Entity audit team expects to read. NERC CIP audit evidence support
-
Board Briefing
The operating risks and the investment decisions in plain language, presented by the practitioner who found them. Executive cyber risk advisory
Sector Assessments for Ports, Water and Utilities
Maritime facilities and terminal operators
Port facilities, terminals and vessel systems, with vendor access, cargo handling technology and recovery planning in scope.
Water and wastewater operators
Treatment and distribution control systems, remote lift stations and the remote access that connects them to operators on call.
Utility and energy operations
Business to OT boundaries, technical audit support and forensic readiness for electric, gas and multi service utilities.
Methodology
Operating Limits First, Board Priorities Last
-
Scope: systems, sites and limits
Sites, systems, excluded actions, stop conditions and production access are agreed in writing with the people accountable for the process.
-
Observe: passive discovery
Approved captures and configuration exports reveal assets, protocols and connections without sending a packet the plant did not expect.
-
Validate: controlled checks
Active checks run only where operations authorizes them, on a test bench, a replica or inside an approved window, one named target at a time.
-
Confirm: review with operators
Your engineers review each finding, because the people who run the process know which exposure is theoretical and which would stop production.
-
Prioritize: consequence and cost
Findings are ranked by operating consequence alongside CVSS, and leadership receives the decisions and the investment each one requires.
Deliverables
What Engineering, Auditors and the Board Receive
Each record separates what we observed in the configuration, what we validated and what it would mean for the process, so an engineer can act on it, an auditor can trace it and a board can decide on it.
Safety and availability limits are written into every finding, not added after testing.
Need a particular record for an audit or a regulator? Call (800) 868-8189 and we will build it into the scope.
- Rules of engagementThe systems in scope, the exclusions, the approved windows, the stop conditions and the people who signed off.
- Asset and access path mapWhich assets communicate, over which protocols, across which zones, and every path that reaches an engineering function.
- Validated findingsEach exposure with the evidence behind it, the access it required and the conditions under which it was confirmed.
- Consequence ranked remediation planCorrections ordered by process impact, each with an owner and a maintenance window the plant can actually schedule.
- Operational constraints registerThe safety, availability and process limits that shaped the testing and the risks operations chose to accept.
- Retest recordProof of which corrections held after remediation and which items remain open.
Who leads the work
Industrial Findings From a Practice That Testifies
When an industrial finding has to be explained to a board, a regulator or a court, the people who made it are the people who explain it, and GDF examiners have testified in federal and state courts.
See the background of Joseph Caruso and the team who would brief your board.
Why it matters on the plant floor
A finding written by people who are used to defending their work under cross examination is specific about what was observed, how it was obtained and what it does not cover, which is what an engineering manager needs before approving a change to a running process.
Field context
Legacy Equipment Changes How a Test Is Run
A thirty year old controller and a physical process on the other end of the cable change every assumption an office network test makes.
Controllers that cannot be patched on demand
Programmable controllers, RTUs and drives often run firmware that can only change during an outage. We examine the implementation as it actually stands, including shared credentials and physical access, because the risks most likely to stop a process rarely need a sophisticated exploit.
Baseline, remediation and retest in sequence
An authorized baseline can come before remediation, and a separate retest afterwards records the changes your engineers made, so improvement is documented for the next audit rather than asserted in a meeting.
Contractor badges and stolen VPN credentials
An intruder with a contractor badge and an intruder with a stolen remote access credential end up at the same controller, so we assess physical, personnel and network paths as one plan with clear owners.
To scope this work for your environment, request a free consultation with a senior specialist.
Free preparation tools
Download the OT Assessment Readiness Pack
The readiness pack is the fastest way to a scoped proposal. Its CSV workbook records the sites, systems, owners, safety boundaries and approved windows an assessment will ask about, and the printable checklist walks your engineers through each decision before the first call.
OT Assessment Readiness Pack
Inventory, boundaries and rules of engagement to settle before testing, in an editable workbook.
Format: ZIP with a CSV workbook, instructions and a printable checklist.
OT Security Review Preparation Guide
Process scope, system inventory, access records and operating constraints to gather before an assessment team arrives.
Format: PDF, also readable online.
OT Assessment Planning Library
Four sector planning packs, a project workbook and shared source records for a multi site program.
Format: ZIP with PDFs, an XLSX workbook and CSV records.
Assessment Preparation Worksheet
Proposed scope, owners, safety boundaries and permissions for an audit, assessment or test.
Format: Editable CSV.
More planning material by subject is in the GDF preparation package library.
Frequently asked
Operational Safety, NERC CIP and First Assessments
Will testing disrupt operations?
The method is designed around that concern. Work starts with records and passive observation, and any active validation runs only against targets, methods and windows your operations and engineering leads approve in writing, with stop conditions and recovery support agreed in advance. Checks that a device cannot tolerate run on a test bench or a replica instead of production.
Do you work within NERC CIP evidence requirements?
Yes. Where NERC CIP applies, we identify the requirement, the control and the supporting record before work begins, and the findings and remediation records are organized so they go straight into the audit evidence package. Our NERC CIP audit evidence support covers that work in detail.
Can you support an active incident?
Yes. Call the 24/7 hotline at (800) 868-8189 to discuss an incident affecting industrial systems. Our examiners preserve evidence with safety and availability in mind, and an Incident Response SLA commits response times and hourly rates before you need them.
Where should a first assessment start?
Usually with remote access and the boundary between the business and control networks, because a stolen remote access credential or a permissive boundary rule is the shortest route from the business network to the controllers. Passive asset discovery often runs alongside it so the scope rests on what is actually connected rather than on the drawing.
What should we have ready for the first call?
The sites and systems involved, a recent network diagram if one exists, the remote access arrangements you know about and the maintenance windows you could offer. The OT readiness pack on this page organizes all of it.
Talk with an examiner
Plan Security Around the Way Your Operation Actually Runs
Tell us the systems, the evidence you need and the deadline. We review relevant experience, potential conflicts and the scope before engagement, and the first consultation is free. Keep network diagrams, credentials and incident details out of this form; we arrange a secure exchange for those.
Global Digital Forensics has operated since 1992. The hotline is answered 24/7, and our examiners have testified in federal and state courts.
Talk with an OT specialist
Walk a Senior OT Specialist Through Your Plant
The first call maps which sites and systems are in play, which engagement answers your question, the windows operations can offer and what the deliverables will look like, and it costs nothing.
Our 24/7 hotline is (800) 868-8189.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .