OT Cybersecurity & Network Security
Network segmentation, IEC 62443 gap analysis, monitoring and incident response.
OT security starts at the control cabinet.
A production environment has different constraints than an IT network. Availability and security weigh heavier than in an office environment.
Common mistakes:
Office and production networks aren't separated. An infected office PC reaches the controllers directly.
Remote maintenance access stays open years after the project ends — often without two-factor authentication.
Controllers talk unencrypted on the same network as printers and PCs. Reading or tampering with data is trivial.
No complete list of which devices run which firmware in production. Vulnerabilities go unnoticed.
What we secure.
Six building blocks, structured to IEC 62443. From network segmentation to hardening & asset management.
Get in touchNetwork Segmentation
DMZ Architecture
IEC 62443 Gap Analysis
OT Threat Detection
Incident Response for OT
Hardening & Asset Management
Defense in Depth.
The approach relies on multiple independent layers:
- Perimeter: firewall between office and production with deny-by-default
- Network: VLAN segmentation, monitored crossings, protocol filters
- Cell: industrial firewalls in front of critical equipment cells
- Host: application whitelisting on engineering workstations and HMIs
- Asset: hardened endpoints, signed firmware, backup strategy
A single layer isn't enough. Only the combination of multiple layers slows attackers down long enough to detect activity and take countermeasures.
Standards & frameworks.
IEC 62443
Standard series for industrial automation and control systems (IACS). We work to -2-1 (management), -3-2 (risk assessment with zones and conduits), -3-3 (system requirements and Security Levels) and -4-1 / -4-2 (component requirements).
NIS2 Compliance
EU directive for essential and important sectors. Obligations: risk management, supply-chain security, incident reporting (24h early warning, 72h notification). The OT-side measures are documented to IEC 62443.
TISAX / B3S
TISAX: sector assessment for automotive suppliers. B3S: sector-specific security standards for critical-infrastructure operators (BSI). We prepare the OT side and deliver the evidence.
How we work.
Four phases — from inventory to ongoing operation.
Assessment
On-site survey of network, assets and processes. Gap analysis against IEC 62443. Output: prioritised risk list with concrete actions and effort estimates.
Concept & Design
Target architecture for segmentation, DMZ, remote access and monitoring. Aligned with the plant team.
Implementation
Step by step, no production stop. Firewalls, switches and monitoring devices are installed in planned maintenance windows.
Operation & Response
Monitoring triage, recurring reviews, incident drills. Optionally, a service contract with defined response times is available.
FAQ
Frequently asked questions.
What does IEC 62443 cover?
IEC 62443 — often cited as ISA/IEC 62443 — is the international standard series for the cybersecurity of industrial automation and control systems (IACS). It covers management (IEC 62443-2-1), risk assessment with zones and conduits (IEC 62443-3-2), system requirements and Security Levels SL 1–4 (IEC 62443-3-3) and requirements for component suppliers (IEC 62443-4-1 and 4-2). Certifications like ISASecure are based on this series.
How is OT security different from classic IT security?
In OT, availability comes before confidentiality. A PLC can't be rebooted every Patch Tuesday, industrial controller lifecycles run 15–25 years, and an active vulnerability scan can drop a plant into fault mode. That's why OT security under IEC 62443 relies on passive monitoring, network segmentation and Defense in Depth — while ISO 27001 covers the office side. The two complement each other; neither replaces the other.
Does production have to stop for the implementation?
No. Asset discovery runs passively and carries no risk for PLC or SCADA. Network segmentation, IDMZ deployment and monitoring sensors are installed in agreed maintenance windows — each step with a rollback plan. Where patching isn't technically feasible, compensating controls are used.
What does an IEC 62443 gap analysis deliver?
A target/actual comparison against IEC 62443-2-1 and -3-3, embedded in a risk assessment per IEC 62443-3-2. The output is a prioritised action list with Security Level Target per zone, effort estimates and a rationale for each conduit — the basis for internal sign-off, audits or later ISASecure certification.
How do NIS2 and critical-infrastructure regulations affect OT projects?
NIS2 requires essential and important entities to maintain risk management, supply-chain security, reporting duties (24-hour early warning, 72-hour notification) and demonstrable technical measures. Critical-infrastructure operators in Austria and Germany also follow sector-specific security standards (B3S / BSI). The OT side — asset inventory, IT/OT segmentation, OT monitoring, incident response — is documented to IEC 62443 and is therefore audit-ready.
Does OT security also make sense for smaller plants and SMEs?
Yes — often more than expected. A focused entry point with asset inventory, IT/OT separation and Defense in Depth covers most of the risk at moderate cost. For Styrian SMEs, funding via the Silicon Alps Peak Performer 2.0 programme is available; digitalisation and cybersecurity projects are explicitly eligible.