How we work
In control systems, availability comes first.
We use a gateway that terminates and inspects control protocols, not one that just passes the network through.
Typical starting points
- „Our firewall sees IEC 60870-5-104 as network traffic, not as a command.“
- „A standard IT security tool would stop our plant if it intervened actively.“
What we do
We place a gateway between IT and OT that terminates common control protocols such as IEC 60870-5-104 and Modbus itself and inspects the content, instead of just forwarding the network traffic. Detection is behavior-based: it recognizes a command that doesn't fit the plant, even when no signature exists for it. Every measure accounts for the fact that process IT must not go down: we intervene without stopping the plant.
How we start
- Week 1
Assessment
Which protocols and devices are in use, and where IT and OT connect today.
- Weeks 2 to 4
Concept
Where the gateway sits, what gets terminated and inspected, and what happens in a fault condition.
- afterward
Implementation
Alongside the running plant, without interrupting operations.
For your IT
Protocol termination for IEC 60870-5-104 and Modbus, separation of IT and OT, behavior-based detection at the control level, integration with existing control systems.
Signatures assume a known attack. In control systems they often see nothing, because a manipulated command stays syntactically valid. Behavior-based detection checks whether the command fits the plant.
No, that's the starting condition. Every measure is built so process IT keeps running. Where an intervention could affect availability, we agree it with you beforehand.
No. The gateway sits between IT and OT and works with what's already in place at your site.
Where does your IT connect to the plant today?
30 minutes. We look at your control systems and the interfaces to IT.