OT and ICS Security
IT/OT Segmentation Validation
We determine which traffic actually passes between the corporate network, the DMZ and the production network. We show the real-world effect of firewall rules.
What it is
The validation examines the boundary between the two networks from two perspectives. First, firewall rules and routing configuration are reviewed. Then, controlled tests measure which traffic these rules actually allow. The gap between expected and actual traffic reveals segmentation weaknesses.
Scope
- Review of firewall rules between the corporate network, the DMZ and the production network
- Identification of overly broad permissions and unused rules
- Measurement of which ports and paths are actually open using controlled tests
- Review of data flows passing through the DMZ
- Detection of unexpected direct paths from the corporate network into the control network
The need
When organizations need it
- When a production line needs to connect to the corporate network to transfer data to ERP or MES systems.
- After a ransomware incident, when it is necessary to determine whether there is a path from the corporate network into production.
- When firewall rules have accumulated over the years and it is unclear which are still needed.
Method
How we work
-
Rule review
We obtain the firewall and routing configurations and extract the permissions line by line.
-
Validation
Under your operations team's supervision, we measure in a controlled manner which paths are actually open.
-
Comparison
We compare the expected boundary with the actual traffic and flag any open paths.
Outcome
What you have at the end
A list of actual traffic between the corporate and production networks, and a breakdown of rules that weaken segmentation with recommended fixes.
Frequently asked questions
Can the test harm the production network?
Tests are performed in a limited manner under your operations team's supervision. Steps that could affect production are taken only during a maintenance window and with your approval.
Is reviewing only the firewall rules sufficient?
Rules often do not fully reflect reality. A routing error, a second network card or a forgotten connection can create a path outside the rules.
OT and ICS Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting