Securing OT across more than forty industrial sites can be a significant undertaking, where the estate has grown through decades of engineering decisions, the equipment and the maturity differ from site to site and the people who can act on an alert sit in operations, not in the security function.
It’s common to consider network segmentation and segregation first, as it’s one of the strongest security controls and typically where a programme proposal starts, however it’s rarely where a programme at this scale can start. This one started with an asset inventory and a connected response organisation, and did the segregation the existing firewalls could carry.
Once ownership, criticality and location were mapped, the same kind of OT malware incident that had taken weeks took minutes. A score that put each site next to its peers drove investment without the programme pushing, and the sites it left with weak segregation went to the right steering level as a decision.
The decision
As initial project manager and cyber lead I proposed, and the steering group accepted, that we start with an asset inventory, mapped to owner, business criticality and location, and connect OT incident response into the structures the company already ran. Inventory came first in sequence, and the network, endpoint protection and backup work built on it.
OT asset management is an established practice, however at the time it was seen as IT operations work, not cyber work, and the CISO and the executives had to be persuaded that it was the foundation. The argument that carried it was a simple one: if we don’t know what we have, we can’t protect it.
Scope followed the same logic. Routed devices defined the collection boundary. It was set by what response needed, not by completeness.
The programme covered six areas: inventory, network, protection, credentials, backup and competencies. All six were in scope at every site, and the emphasis between them followed each site’s existing maturity. The programme targeted the common threats a global manufacturing company faces, with availability first.
What was set aside, and what it would have cost
Segmentation first was the alternative on the table, meaning new firewall hardware and process-level segmentation. The programme did the segregation it could with the firewalls already in place. At the estate’s maturity, one major mill’s physical cable survey and initial planning alone, before a single segment was built, was priced at a level the steering group wouldn’t accept, and the production disruption of retrofitting isolation into running plants sat outside the acceptable boundary. Inventory was achievable, gave immediate value and told us where segmentation would pay off later.
A parallel OT response organisation was the second alternative, and it was never priced. Consistent with the principle that the owner keeps the responsibility and the same structures run in a crisis as in daily operations, we extended what existed: OT plugged into IT major incident management and the site crisis organisation, with the site IT service delivery manager as the link between mill and global response. Building something separate would have been waste, and it would have asked people to work in a crisis through a structure they’d never used on a normal day.
Telemetry-first was the third, and the one suppliers sell. It was discussed and dropped on cost, and the order we followed was people, then process, then technology, because a detection the plant can’t act on safely is a faster alarm, not a faster response.
The problem and the constraints
The programme came out of an executive decision to formalise accountability for cybersecurity under IT as a function, driven by an evolving risk picture. That mandate created the need to assess the OT estate and formulate a programme for it.
What we found was variance. Every site had different equipment, different maturity and different local practices, and the response structures reflected it: IT ran major incident management centrally, each mill had its own crisis response built for fires, chemical spills and workforce safety, OT sat between and reported into engineering or operations, and nobody had designed the joins.
The governance reflected that. The programme was IT-led, with a steering group of business and OT people from the business areas and selected sites, however in IEC 62443 terms the business owned the assets and the site OT teams, internal and supplier, operated them.
The budget was a fraction of a percent of annual turnover, covering asset inventory, fundamental protection capabilities and training across all sites. And the change windows belonged to the plants, with continuous-process sites getting one or two a year, in a queue that security doesn’t set.
What we did
The first work wasn’t technical. It was trust-building with the key OT people, groups and sites, because an enterprise IT security team arriving at OT’s door isn’t always welcome, and the programme started with exactly that friction.
The feasibility study ran with representatives from each business area, each with their own reference group for their sites, so the assessment of what needed most focus was made by the people who ran the plants rather than delivered to them. The side effects of putting those people in one room were real: in a break in one session, an OT engineer with an unsolved problem on a technology and its supplier found that a colleague from another business area had already solved it with a different supplier, and the details and contacts crossed the table there and then.
Three pilot sites followed, from different geographies and business areas, one large, one medium and one small. The pilots did two jobs: they demonstrated the concept to the steering group, which is what gave it the confidence to commit to the full implementation, and they showed where the plan and the approach needed adjusting. The remaining sites were then onboarded on the adjusted approach, with a per-site plan to identify where each needed most focus.
The pilot sites got a final pass at the end, to close whatever the changes in approach or scope had left in their backlog.
What changed
An OT malware incident had taken weeks, because the only thing known about the infected devices was a naming pattern. The same kind of incident took minutes once ownership, criticality and location were mapped. I measured that after the inventory was in place, and it was recognised by everyone who had sat through the weeks.
The starting estimate of OT devices in scope spanned a factor of more than seven. The inventory replaced the range with a count, site by site, so security decisions stopped resting on a guess.
What is important to understand is that the cybersecurity score, designed to report baseline against improvement at device, site and business-area level up to the CISO, took on a life of its own. Business leaders started asking why their score was lower than a peer’s, and that question drove investment without the programme pushing.
The score also showed where the programme stopped. Sites with low physical network segregation scored low on it, and that became an investment discussion or a risk acceptance discussion at the right steering level, site by site, rather than a programme deliverable. Segmentation is still the strongest control, and the programme’s job was to make the decision about it an informed one at each site.
What I’d do differently
The programme made gaps visible faster than it settled who would close them. Endpoint gaps showed up at every site, while maintenance stayed with automation. The handover to operations was still open when the rollout started, and so was the service supplier’s scope for assets now in local hands. Today I’d agree both before the first site.
The different phases also required different competences. Design needed people who understood both IT and automation. Rollout needed site automation people with time set aside, outside the maintenance breaks. Run needed a service supplier with OT security competence, which the existing IT service did not yet have. Finding that mix was difficult, and when we found a gap we did not always address it early enough. Some deliverables were delayed as a result.
The decision also had a cost, and it fell on the oldest devices. Endpoint protection can do little for equipment past supplier support, and isolation is what protects it. Putting inventory first meant those devices waited longest for segmentation. I’d still make the same call. But I’d name that cost at the start. Each site’s plan would put isolation of legacy devices first, as soon as the inventory showed where they were.
Related work
- Response to Dale Peterson on the evidence, scope and cost of the inventory component.
- The OTI Score needs a partner on how OT response was wired into IT major incident and site crisis structures.
- OT telemetry in the SOC is the easy part on the people, process, technology order.
- Manufacturing’s VM problem isn’t a VM problem on why the supplier calendar and the change window set the pace for legacy OT.