Solution · OT/ICS Cybersecurity
Secure the Control Systems Behind Power, Production and Supply.
The Challenge
Industrial control systems were engineered for uptime and are now exposed through remote access and IT/OT convergence.
The Outcome
- Safe, reliable supply
- Reduced IT-to-OT pivoting risk
- Visibility across the IT/OT boundary
Executive Summary
- 01OT security protects process safety and supply continuity, so every control must be chosen for how it affects the plant.
- 02Zones, conduits and a governed IT/OT boundary limit how far an intrusion can travel.
- 03Passive monitoring and incident response rehearsed with operations turn visibility into safe decisions.
The Challenge
Industrial control systems were engineered for uptime and are now exposed through remote access and IT/OT convergence.
An intrusion that pivots from IT into OT can halt supply or create safety incidents.
The DAAKYI Approach
DAAKYI assesses OT risk and maturity, engineers segmentation and secure SCADA design, and extends monitoring and response to OT.
Every change is planned with operations around safety windows.
Delivered Through These DAAKYI Services
- 01
OT risk and maturity assessment
- 02
Segmentation and secure SCADA
- 03
OT monitoring integration
- 04
OT incident response
In Depth
How the Solution Comes Together
Why OT Differs from IT Security
In an IT network, the priority order is confidentiality, integrity, then availability. In a control environment the order flips. A pump, breaker or conveyor must keep running, and a wrong command can injure people or damage equipment. That changes every security decision. Patching may need a planned outage. Active scanning can crash a fragile controller. Endpoint agents often cannot be installed on programmable logic controllers at all. Security for these systems therefore relies on architecture, passive observation and compensating controls instead of the tools that work on laptops and servers. The aim is to prevent harmful commands.
Zones, Conduits and the IT/OT Boundary
Segmentation is the core structural control. Assets are grouped into zones by function and consequence, such as a safety system zone, a control zone and a supervisory zone. Conduits are the only permitted paths between zones, and each one carries explicit rules on protocol, direction and endpoints. IEC 62443 uses this zone and conduit model. Between enterprise IT and the plant sits a demilitarized zone that brokers data, so historians and reporting servers never need a direct line into controllers. Remote vendor access terminates there too, with session approval, multifactor authentication and recording. Flat networks are the usual starting point.
Monitoring Without Disturbing the Process
OT monitoring usually begins with passive network taps or SPAN ports that copy traffic to a sensor. The sensor decodes industrial protocols such as Modbus, DNP3 and OPC UA, builds an asset inventory and learns normal communication patterns. Alerts then fire on new devices, new conversations, unexpected function codes or controller program changes. Those alerts mean little in isolation. They gain value when correlated with IT signals such as a compromised credential or a remote session, so analysts can see an intrusion crossing the boundary. Playbooks must name who may isolate a link, and who must approve it, because containment can stop production.
In a control environment, the best security change is the one the process never notices.
Capability Matrix
What the Service Includes
OT Assessment
Risk and maturity across sites.
Segmentation
IT/OT boundary enforced.
Secure SCADA
Security built into control design.
OT Monitoring
OT telemetry scoped per engagement.
Operating Model
Delivered from the GUIDE · SECURE · OPERATE Pillar
Pillar position
GUIDE · SECURE · OPERATE
Delivered across all three pillars
Engagement model
Project Implementation
Design and deployment of security technologies.
Best for · Modernization and transformation
Engagement model
Advisory Engagements
Fixed-scope assessments, strategy, compliance and testing.
Best for · Defined questions with a clear deliverable
Engagement model
Managed Security Services
SOC, MXDR and managed cloud security under SLAs.
Best for · 24/7 coverage without building in-house
Threat Scenarios
What It Looks Like in Practice
Ransomware Pivot from IT
How It Shows Up
A domain administrator credential is used from a business workstation to reach a jump host, then historian servers begin encrypting files.
Response
Boundary rules and the demilitarized zone limit spread, and monitoring flags the crossing early. Operations can switch to manual or isolated running while IT recovers.
Compromised Vendor Remote Access
How It Shows Up
A maintenance account signs in outside the agreed window and opens engineering software.
Response
Brokered sessions require approval, multifactor authentication and recording. Dormant vendor accounts are disabled until a scheduled task needs them.
Unauthorized Controller Change
How It Shows Up
A program download reaches a controller with no matching change ticket.
Response
Monitoring compares activity with the approved baseline and alerts. Engineers verify the logic and restore a known-good backup if needed.
Rogue Device on the Control Network
How It Shows Up
A contractor laptop or cellular router appears in the asset inventory without an owner.
Response
Inventory alerts trigger investigation, and switch port controls prevent unregistered devices from joining the segment.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Ransomware Pivot from IT | A domain administrator credential is used from a business workstation to reach a jump host, then historian servers begin encrypting files. | Boundary rules and the demilitarized zone limit spread, and monitoring flags the crossing early. Operations can switch to manual or isolated running while IT recovers. |
| Compromised Vendor Remote Access | A maintenance account signs in outside the agreed window and opens engineering software. | Brokered sessions require approval, multifactor authentication and recording. Dormant vendor accounts are disabled until a scheduled task needs them. |
| Unauthorized Controller Change | A program download reaches a controller with no matching change ticket. | Monitoring compares activity with the approved baseline and alerts. Engineers verify the logic and restore a known-good backup if needed. |
| Rogue Device on the Control Network | A contractor laptop or cellular router appears in the asset inventory without an owner. | Inventory alerts trigger investigation, and switch port controls prevent unregistered devices from joining the segment. |
Outcomes
What Your Institution Gains
- Safe, reliable supply
- Reduced IT-to-OT pivoting risk
- Visibility across the IT/OT boundary
Methodology
The Method, Step by Step
- 1
Scope and Inventory
Define sites, processes and safety boundaries first. Build an asset inventory from documentation, walkdowns and passive observation, noting vendor, firmware, protocols and connections. Identify the consequence of losing each process. Without an inventory, every later decision rests on assumption, and unmanaged devices stay invisible.
- 2
Assess Risk and Maturity
Evaluate architecture, remote access, accounts, patching constraints and backup of control logic against a chosen standard such as IEC 62443 or NIST SP 800-82. Rank findings by consequence to safety and supply, not only by technical severity. The output separates quick fixes from changes that need outage windows.
- 3
Design Zones and Controls
Draw zones and conduits, define the demilitarized zone, and specify firewall rules, remote access brokering and authentication for each path. Review the design with control engineers and the vendor so that it respects protocol behavior, latency needs and support agreements. Document the intended state so deviations can be detected.
- 4
Implement in Safety Windows
Sequence changes by risk. Test firewall rules and sensors in a lab or on a non-critical segment first. Apply changes during planned maintenance with rollback steps agreed in advance and operations staff present. Verify process behavior after each change before moving on to the next conduit.
- 5
Monitor and Rehearse Response
Tune detection against the learned baseline, forward OT alerts to the security operations function, and write playbooks that assign decisions between security and operations. Run tabletop exercises with plant staff that include manual operation, vendor contact and regulatory reporting. Revisit the design after each exercise and each major plant change.
How It Works
How OT/ICS Cybersecurity Comes Together
- 01Assess
- 02Segment
- 03Monitor
- 04Respond
Regulatory & Industry Context
The Obligations This Service Supports
References NIST CSF and critical-infrastructure duties under Act 1038.
Frameworks DAAKYI helps clients implement
- NIST CSF
- Ghana Act 1038
Framework references describe client implementation support, not DAAKYI certifications.
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| OT Asset Inventory | Provides a verified list of devices, firmware and connections on which every other control depends. |
| Risk and Maturity Report | Ranks gaps by consequence to safety and supply. |
| Zone and Conduit Design | Specifies which paths are permitted between plant, demilitarized zone and enterprise. |
| Remote Access Standard | Sets rules for vendor and employee sessions into control networks. |
| OT Incident Response Playbooks | Define who decides on isolation, manual operation and escalation. |
| Role | Responsibility |
|---|---|
| Plant or Operations Manager (Client) | Owns process safety and approves outage windows for security changes. |
| Control Systems Engineer (Client) | Confirms that proposed controls will not alter process behavior. |
| CISO or Security Lead (Client) | Sets OT risk appetite and aligns it with enterprise governance. |
| OT Security Architect (Provider) | Designs zones, conduits and monitoring to fit the process and the chosen standards. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc
The network is flat, assets are unknown, accounts are shared and vendor access is unsupervised.
Stage 2
Defined
An inventory exists, the IT/OT boundary has firewall rules, and remote access follows a written standard.
Stage 3
Managed
Zones are enforced, OT traffic is monitored, and alerts reach analysts who understand the process.
Stage 4
Optimized
Detection is tuned to plant baselines, response is rehearsed with operations, and design is revisited after major changes.
Frameworks and Regulation
The Standards That Shape This Work
IEC 62443
It addresses security for industrial automation and control systems and supplies the zone and conduit model used in segmentation design.
NIST SP 800-82
It gives guidance on OT architecture, risks and controls for industrial environments.
NIST CSF 2.0
Its six functions, Govern, Identify, Protect, Detect, Respond and Recover, give executives a shared structure for reporting OT posture.
Ghana Cybersecurity Act, 2020 (Act 1038)
It provides for designation and protection of Critical Information Infrastructure and for incident reporting, which matters to operators whose systems may be designated.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for engineers who have worked inside control environments and understand how safety systems behave.
- Expect assessments to use passive methods by default and to justify any active testing in writing.
- Require a change plan that aligns with maintenance windows and includes rollback steps.
- Insist on deliverables your operations team can use, not only a findings spreadsheet.
Questions to ask a provider
- How do you assess a site without actively scanning live controllers?
- Who decides on isolating a segment during an incident, and how is that agreed beforehand?
- How will architecture changes affect our equipment vendors' support agreements?
- Which standard do you map findings to, and how do you set priorities?
Technical Detail
For Architects and Security Leads
Protocol-Aware Boundary Enforcement
Industrial protocols such as Modbus TCP carry no native authentication, so any host that can reach the port can write values. Firewalls at conduits should therefore do more than allow or deny ports. Deep packet inspection can restrict function codes, so a historian may read registers but never write them or download programs. Where consequence is high, unidirectional gateways enforce one-way data flow. Engineering workstations deserve their own restricted zone, because they hold project files and credentials that can reprogram controllers. Log both permitted and denied attempts, since a blocked write command from an unexpected host is a strong detection signal.
Baselining OT Traffic for Detection
Control networks are far more predictable than corporate ones. Controllers poll the same devices at fixed intervals, and engineering changes follow scheduled work. Passive sensors exploit that regularity. During a learning period, the sensor records which assets communicate, over which protocols and in which direction. Detection then targets deviations: a new talker, scanning behavior, a controller switched from run mode to program mode, or a logic download without a change ticket. The learning window must include startups, shutdowns and maintenance, or normal variation will create noise. Synchronized clocks and retained packet metadata let analysts reconstruct a sequence across IT and OT.
Glossary
Key Terms
- Zone
- A group of assets that share the same security requirements and consequence profile.
- Conduit
- A controlled communication path between two zones, governed by defined rules.
- Historian
- A server that stores process data over time and often bridges IT and OT.
- PLC
- A programmable logic controller, the ruggedized device that runs control logic for machinery and processes.
Related
Explore Connected Capabilities
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About OT/ICS Cybersecurity
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss OT/ICS Cybersecurity with DAAKYI
Tell us the outcome you need; a DAAKYI specialist will map it to the right services and engagement model.