Expertise
Infrastructure cybersecurity
Technical protection measures for an industrial network: segmentation, access control, logging.
What the protection consists of
Measures that work at the level of the network and equipment and do not interfere with production: zones, rules, personal access and logs.
Segmentation
The process network is separated from the office network; zones and conduits, a DMZ for data exchange with ERP and contractors.
Firewalling
Rules on the principle of deny everything except what is agreed; industrial protocols under control.
Remote access
Contractors and service teams connect through a secure gateway: on request, under a personal account, with session recording.
Accounts
Personal accounts instead of shared passwords, role-based rights, disabling of unused accounts.
Logging
Network, login and configuration change events are collected centrally and sent to monitoring.
Configuration copies
PLC projects, switch and server configurations in a version-controlled repository with backups.
How it works: a scenario
The contractor works with the controller only through the gateway in the DMZ, while a direct connection from the office network is stopped by the firewall and the event is visible in monitoring.
Normal operation
The contractor is connected to the PLC through the remote access gateway in the DMZ: on request, under a personal account, with session recording. The firewall passes only this agreed flow.
Event
A workstation in the office network tries to connect to the controller directly; there is no such rule.
Response
The firewall blocks the attempt and the event goes to monitoring: status, rule, blocked session and log. The contractor's session continues throughout.
Result
The cause is traced in the log, a misconfigured workstation, and the status returns to normal. Agreed access works, denied access does not.
What we do
- Survey: inventory of nodes, protocols and external connections
- OT and IT segmentation by zones and conduits, a DMZ for data exchange
- Firewalling with control of industrial protocols
- Controlled remote access for contractors and service teams
- Accounts and role-based rights, no shared passwords
- Hardened configuration of switches, servers and operator workstations
- Event logging and output to monitoring
- Version-controlled backups of configurations and projects
- Updates in agreed windows, tracking of equipment vulnerabilities
- Procedures for the operations team and technical measures based on the survey
How the work goes
Survey
Actual connections, external access, shared passwords, unprotected protocols; a prioritised list of risks.
Design
Target zone diagram, firewall rules, remote access scheme, equipment specification.
Implementation
Segmentation and rules are introduced in stages: first in monitoring mode, then in enforcement mode, checking that exchange is not disrupted.
Verification
Rules and access are checked under a programme, with a report on the results.
Support
Review of rules when the site changes, log control, updates in maintenance windows.
Typical tasks
Contractors connect directly to controllers
We build controlled remote access through a secure gateway with session recording.
OT and the office network share a segment
We separate the segments and install a firewall with rules for agreed flows.
No event logs
We enable logging and send events to monitoring.
One shared password on all switches
Personal accounts, role-based rights, a login log.
Exchange with ERP goes directly from the process network
A DMZ with an exchange server, rules only for agreed flows.
Configurations are not stored anywhere
A version-controlled repository of configurations and projects with backups.
What the customer receives
Survey report
A prioritised list of risks and a plan of technical measures.
Zone and rule diagram
Segments, firewalls, agreed data flows, remote access scheme.
Procedures
Remote access, accounts, configuration backups, updates.
Result: a segmented network, controlled access and event logs.
Questions
Will data exchange stop during segmentation?
No. Rules are introduced in stages: first in monitoring mode, then in enforcement mode, with every data flow checked.
Do you carry out security assessments?
We carry out a technical survey of the network and implement technical protection measures. The scope of security assessment work is agreed when the contract is concluded.
Does a small site need these measures?
Yes, if there are controllers and external connections: segmentation, controlled remote access and personal accounts are the basic minimum.
How is contractors' work controlled?
Through a secure gateway: access on request for the duration of the work, a personal account, session recording, an activity log.
09Contacts
Let us discuss your engineering task
Describe the site and the task: survey, modernisation, integration or support. We will reply and propose a format of work.
What happens after you get in touch
- Phone
- +7 777 824 89 99 (WhatsApp)
- info@net-core.kz
Contact us directly
Call us, message us on WhatsApp or send an e-mail — tell us about the site and the task.