First find out what's on the plant network, then decide how to protect it.
Control networks were built to keep processes running. Vendors connect in remotely, flat networks link the office to the PLCs, and the asset list is a spreadsheet from the last turnaround. We start with passive visibility. Segmentation, remote access lockdown and monitoring follow, without stopping production.
SOC and SIEMOT playbooksVendors and engineersapproved sessions
OT security: Claroty, Nozomi, DragosAVEVA PI & AspenTech IP.21Microsoft Entra IDCyberArk
in short·15-second read
OT and ICS security protects the operational technology that runs physical processes.
That means PLCs, SCADA, DCS and safety systems in plants, utilities and pipelines. Cohash builds OT asset inventories with passive monitoring tools and designs zone and conduit segmentation following ISA/IEC 62443. We secure vendor remote access. We assess sites against ISA/IEC 62443 and NIST SP 800-82, and tie OT threat monitoring into your SOC.
you probably need this if
The OT asset list is a spreadsheet from the last turnaround.
Vendors connect to HMIs with remote desktop tools installed years ago.
Office and control networks share a flat network with few firewall rules.
From the first call to a setup your own team can run.
Here's what usually prompts a call about your OT & ICS Security, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · ot & ics security3 open
openThe OT asset list is a spreadsheet from the last turnaround.
recurringVendors connect to HMIs with remote desktop tools installed years ago.
blockedOffice and control networks share a flat network with few firewall rules.
exposure
Passive asset visibilityZones, conduits and segmentationSecure remote accessStandards-based assessmentsOT threat monitoringRegulated sector support
startrehearsehandover
Visibility first
Assess against consequence
Fix in maintenance windows
Monitor and hand over
we are here
ready to hand over
Every remote session now goes through one approved path, with a named user and a…
The only way office traffic reaches the plant now is through defined conduits.
The SOC hands OT alerts to the right person at the site, with context attached.
OT asset inventory with firmware, protocols and communication paths
chapter 01 · where it hurts
Why teams reach out
The OT asset list is a spreadsheet from the last turnaround.
Vendors connect to HMIs with remote desktop tools installed years ago.
Office and control networks share a flat network with few firewall rules.
chapter 02 · what we change
How we solve it
Passive asset visibility
Zones, conduits and segmentation
Secure remote access
Standards-based assessments
OT threat monitoring
Regulated sector support
chapter 03 · how it runs
Our approach
Visibility first
Assess against consequence
Fix in maintenance windows
Monitor and hand over
chapter 04 · where you end up
What changes
Every remote session now goes through one approved path, with a named user and a recording.
The only way office traffic reaches the plant now is through defined conduits.
The SOC hands OT alerts to the right person at the site, with context attached.
OT asset inventory with firmware, protocols and communication paths
what we do
Where we spend the hours
6 areas of work, each one done by an engineer who has run it in production.
We put OT monitoring sensors such as Claroty, Nozomi Networks Guardian, Dragos or Microsoft Defender for IoT on SPAN or TAP ports. They build the asset inventory, with firmware, protocols and communication paths, without actively scanning devices that might fall over.
We design zones and conduits based on ISA/IEC 62443, write firewall rules between IT and OT and between process areas, and set up an industrial DMZ for historians, patch servers and remote access.
Vendor and engineer access through a controlled jump path with individual accounts, MFA, session recording and time-bound approval, replacing always-on VPNs and remote desktop tools installed on HMIs.
Site assessments against ISA/IEC 62443 and NIST SP 800-82 Rev. 3. Findings are ranked by consequence to safety and production, and the remediation plan fits around maintenance windows.
OT sensor alerts routed into your SOC with OT-specific playbooks, using MITRE ATT&CK for ICS to describe techniques, and a clear rule on who may act on a control network.
If you run pipelines, that might be TSA security directives. For electric or water, it's your sector rules. We map the work to whichever requirements apply and produce evidence your compliance team can use.
capability 01 / 06in production
Passive asset visibility
We put OT monitoring sensors such as Claroty, Nozomi Networks Guardian, Dragos or Microsoft Defender for IoT on SPAN or TAP ports. They build the asset inventory, with firmware, protocols and communication paths, without actively scanning devices that might fall over.
We design zones and conduits based on ISA/IEC 62443, write firewall rules between IT and OT and between process areas, and set up an industrial DMZ for historians, patch servers and remote access.
Vendor and engineer access through a controlled jump path with individual accounts, MFA, session recording and time-bound approval, replacing always-on VPNs and remote desktop tools installed on HMIs.
Site assessments against ISA/IEC 62443 and NIST SP 800-82 Rev. 3. Findings are ranked by consequence to safety and production, and the remediation plan fits around maintenance windows.
OT sensor alerts routed into your SOC with OT-specific playbooks, using MITRE ATT&CK for ICS to describe techniques, and a clear rule on who may act on a control network.
If you run pipelines, that might be TSA security directives. For electric or water, it's your sector rules. We map the work to whichever requirements apply and produce evidence your compliance team can use.
We pieced these together from OT & ICS Security situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Remote desktop tools on every HMI at a water utility
composite · not a client story
Beforethe situation
Over several years, vendors and on-call engineers have installed remote desktop software to reach the HMIs. Some sessions run on shared accounts. Nobody can say which tools are on which machines.
What we dothe work
Find remote access traffic with passive monitoring and inventory the tools on each HMI. Vendor access then goes through a jump path with individual accounts, MFA and session recording. The old tools come out in the next maintenance window.
Afterwhere you end up
Every remote session now goes through one approved path, with a named user and a recording. The remote desktop tools nobody could account for are gone from the HMIs.
case file 02
Office and control networks on the same VLANs at a manufacturing site
composite · not a client story
Beforethe situation
Production lines and office PCs sit on one routed network with only a few firewall rules. Ransomware in the office would have a direct route to the HMIs and engineering workstations.
What we dothe work
Run passive sensors for several weeks to map the paths actually in use, then define a zone for each production area with an industrial DMZ between IT and OT. Firewall rules start in monitor mode and are enforced during a planned stop.
Afterwhere you end up
The only way office traffic reaches the plant now is through defined conduits. We wrote the rules from observed traffic, which is why production keeps running after enforcement.
case file 03
The SOC gets OT alerts and doesn't know what to do with them
composite · not a client story
Beforethe situation
OT alerts land in the SIEM, and the SOC has no way to judge them. Is a new engineering workstation talking to a PLC routine or a problem? Nobody on shift can say, so the alert gets closed.
What we dothe work
Tune the alerts with plant engineers to filter out known-good behavior. Write playbooks telling the SOC what to check and who to call at the site, and agree that only plant staff take action on control networks.
Afterwhere you end up
The SOC hands OT alerts to the right person at the site, with context attached. Anything that affects the process stays the plant staff's call, every time.
Field devices and controllers sit in process zones, separated by conduits from supervisory systems. An industrial DMZ holds the historian and remote access path, passive sensors watch OT traffic, and alerts flow to the enterprise SOC.
01 · Field and control
PLCs and controllersModbus · EtherNet/IP · S7 → SCADA and HMI · process data→ OT monitoring sensor · mirrored traffic
Safety systemsSIS · own zone → SCADA and HMI · status only
02 · Supervisory
SCADA and HMIoperators · engineering → OT monitoring sensor · mirrored traffic→ Historian · conduit
OT monitoring sensorpassive · SPAN or TAP → SOC and SIEM · OT alerts
PLCs and controllers → SCADA and HMI: process data
PLCs and controllers → OT monitoring sensor: mirrored traffic
SCADA and HMI → OT monitoring sensor: mirrored traffic
SCADA and HMI → Historian: conduit
OT monitoring sensor → SOC and SIEM: OT alerts
Vendors and engineers → Remote access path: request session
Remote access path → SCADA and HMI: approved access
Safety systems → SCADA and HMI: status only
how it runs
A typical engagement
We don't start a step until the last one has produced something you can check.
step 01
Visibility first
Deploy passive sensors at agreed points and build the asset and communication inventory with plant engineers.
step 02
Assess against consequence
Map assets to zones, review against ISA/IEC 62443 and NIST SP 800-82, and rank findings by safety and production impact.
step 03
Fix in maintenance windows
Segmentation, remote access and hardening changes planned around turnarounds and tested with operations before cutover.
step 04
Monitor and hand over
We tune OT alerts and route them to the SOC. Playbooks get agreed with operations, and we write runbooks for both the plant and security teams.
you keep
What you're left with
We write these for your OT & ICS Security setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
inventory01
OT asset inventory with firmware, protocols and communication paths
yours to keep
design02
Zone and conduit model with firewall rule sets
yours to keep
design03
Remote access design with approval and session recording
yours to keep
report04
Assessment report against ISA/IEC 62443 and NIST SP 800-82
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your OT & ICS Security work. The ones who've done it answer differently from the ones who've read about it.
Q1
How will you build our asset inventory without disrupting production?
Active scanning can crash older OT devices. A good partner starts passive and can tell you when, if ever, an active query is safe on your kit.
Q2
How do you plan changes around our maintenance windows?
Segmentation and hardening often mean downtime, so a plan that ignores turnaround schedules either stalls or puts production at risk.
Q3
Who on your team has worked inside a control room or on a plant floor?
OT security needs people who understand processes and safety systems, not only IT security. Ask for that experience specifically.
Q4
How will OT alerts reach our SOC, and who is allowed to act on them?
SOC analysts acting directly on OT systems can cause outages. Clear playbooks and roles prevent that.
Q5
Which parts of ISA/IEC 62443 or NIST SP 800-82 will the assessment cover?
ISA/IEC 62443 and NIST SP 800-82 both cover a lot of ground. Find out which requirements and security levels the assessment will use. Otherwise next year's results won't line up with this year's.
01Can you scan our OT network?
We start passive. Active scanning can crash older PLCs and network modules, so we use passive monitoring from SPAN or TAP ports first, and only use targeted active queries where the vendor and plant engineers agree it's safe.
02Which OT monitoring tool should we buy?
It depends on your vendors and protocols, your SOC tools, the number of sites and whether you're already licensed for one. Claroty, Nozomi Networks, Dragos and Microsoft Defender for IoT are common choices. We compare them on your traffic in a pilot if you haven't decided.
03What standards apply to OT security?
The main series for industrial automation and control systems is ISA/IEC 62443. In the US, the OT security guide is NIST SP 800-82 Rev. 3, and NIST has put out a draft Revision 4 for comment. Sector rules may apply too, such as TSA security directives for pipelines.
04How long does an OT security program take?
Visibility at a single site can be fairly quick once sensor placement is approved. Segmentation and remote access changes depend on maintenance windows, which can stretch work over months. Multi-site programs usually roll out site by site.
05Do you also work on industrial IoT and historians?
Yes. Our industrial IoT practice covers data from historians such as AVEVA PI to cloud platforms, and we secure those paths through the industrial DMZ.
06Can you staff OT security engineers?
Yes, through our staffing practice. Engineers who understand both control networks and security are hard to find, and we place them on contract, contract-to-hire or permanent terms.
related
Often paired with
Projects on OT & ICS Security usually end up touching one of these, so they're worth a look.
