Forget the Firewall Fantasy: Real ICS Security Starts Inside the Plant

What Matters, What Breaks, and How to Actually Secure a Power Plant

Cybersecurity in industrial environments isn’t about ticking checkboxes or buying another "security solution." It's just one part of the bigger picture: ensuring control, visibility, and above all, business continuity.

A proven methodology, developed across projects involving multiple OEM platforms, ensures plants become both compliant and operationally resilient — not just on paper. This approach is vendor-neutral, standards-driven, and structured to support daily plant discipline, not just regulatory checklists.

What makes it different is that it doesn’t stop at identifying problems. It delivers a structured, actionable Cybersecurity Handbook — a practical set of processes and procedures that teams can follow, sustain, and audit against.

Our Cybersecurity Assessment Methodology

(0) Cybersecurity Team & Objectives Set up a dedicated team, define roles, and clarify project goals.

(1) Standards Mapping (DEWA, ISO 27001, NESA) We map the applicable regulatory requirements (such as DESC for DEWA) to ISO 27001. Our internal implementation of the NESA framework forms the basis of our cybersecurity requirement database (omlex.dozuki.com).

(2) Asset Inventory & Maintenance and Cybersecurity Datasheets Each asset is documented with a dedicated datasheet that includes:

• Role and criticality
• Known CVEs (NVD and internal KB-IPS)
• Identified gaps and required actions
• Ownership and implementation timeline

(3) Perform the Real Technical Assessment This is where the work happens — system by system, control by control. We look at:

• Backup and restore capabilities
• Network segmentation and firewall rules
• Log forwarding and monitoring mechanisms
• Active Directory presence and user management
• Remote access routes (VPNs, engineering laptops, USBs)
• Operating system patch levels
• Software inventory and outdated toolkits

Across the wide range of platforms and OEM systems we assess — which is often the core challenge in itself — we apply a unified methodology that treats each system consistently, regardless of brand or architecture. Here are just a few practical issues we repeatedly uncover:

• T3000: Legacy Windows systems with no centralized patching; system images with obsolete software; open ports used by engineering tools left running permanently.
• SICAM: Flat networks, insecure protocol configurations, and use of default credentials that haven't been updated since commissioning.
• Ovation: Lack of visibility into middleware communication paths; logs not forwarded; segmented zones only on paper.
• HMI/PLC islands: Engineering laptops connecting via USB or serial with no antivirus; uncontrolled firmware updates; no audit trail.

Sources: NVD, CVE databases, vendor advisories, and our internal vulnerability library.

(4) Cybersecurity Handbook (Final Deliverable) This is not a one-time audit file. It is a living document broken into 20+ functional areas, such as:

• Cybersecurity Governance (CSG)
• Backup Management (BM)
• Logging and Monitoring (LM)
• Incident Response (CSIM)
• Identity Access Management (IAM)
• Vulnerability Management (VM)
• Configuration & Change Management (CCM)

Each section includes actionable procedures:

• Reviewing access lists quarterly
• Managing USB media securely
• Testing system restore monthly
• Validating vendor firmware before installation
• Detecting rogue devices on isolated networks

These become part of daily plant operation — not an IT policy but operational discipline.

Recommended by LinkedIn

Use the Standards – But Translate Them to Reality

For every threat, there must be a control. Here are examples from a standards-based requirement matrix derived from ISO 27001 as implemented through the UAE NESA framework:

THREAT A: Exploitation of Default Credentials

• T4.5.3 - P1: Network segregation
• T5.2.4 - P1: Review of user access rights
• T5.5.3 - P1: User credentials management system

THREAT B: Sending Data to External Entities

• T1.4.1 - P1: Management of removable media
• T5.4.5 - P1: Network connection control

THREAT C: Disable or Interfere with Controls

• T3.4.1 - P1: Controls against malware
• T7.7.1 - P1: Control of technical vulnerabilities

Each one is linked to real checks, real gaps, and real solutions.

What You Get at the End

We don’t deliver just a report. You get:

• Maintenance and Cybersecurity Datasheets for each system
• Task lists covering all required actions to maintain business continuity and address system vulnerabilities
• Cybersecurity Handbook — a structured set of “Processes and Procedures” covering 20+ security domains (IAM, Backup, Logging, Incident Management, etc.)
• Mapped risk matrix with real prioritization

• A real plan, executable by your team or ours

Final Words

And here’s how we embed this philosophy into lifecycle planning:

Our Pragmatic Approach to Obsolescence and Cybersecurity:

• Freeze it: If your HMI system or DCS is working, don’t rush to upgrade. Virtualize what you can. Ask: what do we gain by moving to the latest version — more functionality or more headaches?
• Isolate it: Don’t let unsupported or outdated systems stay connected. Use Service Boxes (jump machines) and one-way data diodes. Segment your network properly — and then treat it like a high-voltage system: no accidental touches.
• Consolidate it: Replace the fragmented vendor-bound hardware landscape with a unified virtual machine infrastructure. Use a standard cabinet across sites — same servers, same storage, same serviceability — and remove hardware variation as a failure point.
• Monitor it: Visibility matters. Deploy OT monitoring tools like GreyCortex to track changes, detect anomalies, and provide early warnings. Install it on your own virtual machine cluster and make monitoring native, not a bolt-on.

This mindset — freezing, isolating, consolidating, and monitoring — is how you turn legacy into an asset, not a liability.

Cybersecurity isn’t the end goal — it’s a supporting function. It’s how you protect business continuity when the unexpected happens.

You don’t need buzzwords. You need structure. And structure is what we build.

Let us know if you want to start with a simple question: "Where are we vulnerable, and what should we fix first?"