The Plant Network Stopped Matching the Diagram Years Ago

Follow the Paths Across the Industrial DMZ

The industrial demilitarized zone sits between the enterprise and control networks and is meant to prevent direct communication between them. Whether it does depends on the services deployed in it, the routes through it, the accounts that can log into it and the rules that govern it.

We compare the diagrams and firewall configuration with traffic captured at agreed observation points and with access records from the systems on both sides. Each communication lands in one of four groups: approved and documented, approved but undocumented, unexplained, or too thinly recorded to judge. The last two groups are where the work is. A historian pushing data to a business intelligence server is expected. The same historian accepting inbound remote desktop sessions from a subnet nobody can name is a finding.

Already holding a list of connections nobody can explain? Bring it to the scoping call and the observation plan will be built around it.

Recommendations Engineering Can Put in a Change Ticket

Telling a plant to disconnect a reporting server solves nothing on its own. Someone in engineering still has to work out what the server does, who depends on it and what breaks when the cable comes out.

So before recommending a change we work through the process model, the dependencies, the operational effect and the effort. Say the reporting server needs one approved data exchange with the historian but currently routes to the whole control subnet. The recommendation names the required exchange by source, destination, port and direction, explains how to narrow the rule to it, identifies the owner, and states what to validate afterward and how to roll back if the report stops populating. An engineer can turn that into a change ticket without calling a second meeting.

To organize the diagrams, owners and change records before committing, start with the OT assessment planning library.

Sorted by When the Work Can Actually Happen

Findings are grouped by when they can realistically be done. Some are access corrections for this week, such as a stale vendor account or a rule that was meant to be temporary. Some need a maintenance window because they touch a running process. Some are architecture improvements for next year's capital plan.

Leadership reads the summary and the first group. The controls team reads the full record: the observed path, the configuration that permits it, the evidence and the proposed change. Both are reading the same finding, written for what each has to do with it, and both can trace every statement back to the technical record.

Have a maintenance window coming up? We will plan the assessment around it.

Scope Your Assessment

Traffic Findings Kept to an Evidence Standard

Each unexplained path in the report cites the capture, the switch table or the firewall line that shows it, the way a forensic examiner cites an artifact, because GDF examiners have testified in federal and state courts and write every record to be checked. Read the team biographies.

If the inventory itself is in doubt, OT asset discovery builds it first. When one path needs proving, network segmentation validation tests it, and ICS penetration testing shows what an attacker could do along it.