OT/ICS Security Audit

Cyberattack Detected by Customer, Not IT

Manufacturing company with SCADA systems managing 6 production lines. Production anomalies - defective products for 2 weeks. It turned out: modified parameters in PLC by malicious software. IT didn’t know about the attack for 14 days. Loss: €82K in defective products and halted production.

Without regular OT audits:

• You don’t know about security vulnerabilities in industrial systems
• Attacks detected too late or not at all
• Outdated firmware versions with critical CVEs
• Lack of segmentation allows attack spread

Audit That Doesn’t Stop Production

We conduct comprehensive OT/ICS security audit using non-invasive methods. We identify vulnerabilities, configuration errors, architecture weaknesses - without affecting production system operation.

What you get:

• Passive OT network mapping and device inventory
• IT/OT segmentation and communication flow analysis
• SCADA, HMI, PLC, DCS configuration review for security
• Passive OT component vulnerability scanning
• Access management and patching assessment
• OT backup and disaster recovery verification
• Report with prioritized remediation plan (risk-based)
• Results presentation for management and technical team

Who Is It For?

This service is for you if:

• You run production on OT/ICS systems and haven’t done security audit
• You need to meet NIS2 requirements for critical infrastructure
• Integrators or customers require OT security audit
• You suspect security issues but aren’t sure
• You’re planning OT security investments and need prioritization

OT/ICS Audit Scope

What Do We Check?

Comprehensive OT environment security assessment:

Network Security

• IT/OT segmentation (Purdue Model)
• Firewall rules between zones
• VLANs and access control lists
• Remote access (VPN, vendor access)

Device Security

• SCADA servers - hardening, patching
• HMI stations - OS security, access control
• PLC/DCS - firmware versions, default passwords
• Engineering workstations - antivirus, patching

Access Management

• Account management (default accounts, shared passwords)
• Multi-factor authentication
• Privilege management
• Session logging and monitoring

Configuration Security

• Communication protocols (plain text vs encrypted)
• Backup procedures
• Change management for OT changes
• Logging and monitoring

Vulnerability Assessment

• Passive CVE scanning for OT components
• Firmware/software version analysis
• Known vulnerabilities for used protocols
• Comparison with CISA Known Exploited Vulnerabilities

What We Look For

Common OT Vulnerabilities

Network Level:

• Flat network - no IT/OT segmentation
• Direct internet access from OT network
• Uncontrolled vendor remote access
• Missing firewall between zones

System Level:

• Windows XP/7 on HMI stations (EOL)
• Unpatched SCADA software
• Default passwords on PLCs
• Unnecessary services enabled

Protocol Level:

• Modbus without authentication
• OPC Classic without encryption
• Telnet/FTP instead of SSH/SFTP
• Clear text protocols on critical segments

Access Level:

• Shared accounts for operators
• No MFA for remote access
• Excessive privileges
• No audit logging

Audit vs Pentest

Aspect	Audit	Pentest
Method	Passive review	Active testing
Risk	None	Minimal (controlled)
Focus	Configuration, compliance	Exploitability
Output	Gap analysis	Exploit proof
Time	2-3 weeks	2-4 weeks
When	Annual, first assessment	After hardening

We recommend: Audit first, then pentest to verify controls.

Related Glossary Terms

Learn more about key concepts related to this service:

• CIS (Center for Internet Security)
• CVE
• ICS
• Information Security Architecture
• OT (Operational Technology)
• SCA
• SSE
• Tor