OT security baseline for plants and pipelines
Cohash sets an OT security baseline for plants, substations and pipeline sites. We trace switches and place passive sensors from Claroty, Nozomi Networks or Dragos, build an asset inventory, group assets into ISA/IEC 62443 zones and conduits, put vendor remote access through one recorded path, and connect OT alerts to your SOC with playbooks that say when to call the plant.
- 01Site walk and switch trace
- 02Passive inventory and baseline
- 03Zones and conduits
- 04Remote access and accounts
- 05SOC integration
The story
Told without the client's name or anything that could identify them.
A pipeline operator's security team couldn't say how many PLCs, RTUs and HMIs ran at each site, and vendor engineers reached controllers through a shared remote desktop account. TSA's pipeline directive still requires segmentation, access control and continuous monitoring, and an insurer had asked for a zones and conduits diagram that didn't exist. We walked pilot sites with controls engineers, traced switch topology by Purdue level and placed passive sensors at agreed SPAN and TAP points. The sites ended up with an asset inventory, IEC 62443 zones and conduits enforced by firewall rules, one recorded path for vendor access, and SOC playbooks that say when to call the plant.
why it was urgentThe rules haven't loosened. TSA's revision 02G of its pipeline security directive, posted on 1 May 2026, still requires segmentation, access control, continuous monitoring and risk-based patching. FERC approved NERC CIP-015-1 on internal network security monitoring in June 2025. And on the vendor side, Mitsubishi Electric completed its Nozomi Networks acquisition on 28 January 2026.
- openNobody can say how many PLCs, RTUs and HMIs run at each site.
- recurringVendor engineers reach controllers through a shared remote desktop account.
- blockedAn insurer or regulator asked for zones and conduits and there is no diagram.
- openOT alerts reach the SOC, but analysts have no playbook for them.
The estate, before and after
Before: flat plant networks and shared vendor access
Vendor engineers reached controllers on a flat plant network through one shared remote desktop account with no recording. The SOC saw occasional OT alerts with no playbook and no inventory to look them up in.
Read the diagram as text
- Vendor engineers → Shared remote desktop: remote desktop
- Shared remote desktop → Flat plant network: direct access
- Flat plant network → PLCs: unsegmented
- Flat plant network → SIEM: occasional alerts
- SIEM → SOC analysts: triage
After: monitored zones, conduits and one vendor path
Vendors can only reach a control zone through a brokered, recorded path and the conduit firewalls. On the monitoring side, passive sensors feed an OT console that pushes alerts to the SIEM and assets to the CMDB, where SOC playbooks pick them up.
Read the diagram as text
- Vendor engineers → Brokered remote access: MFA sign-in
- Brokered remote access → Conduit firewalls: recorded session
- Conduit firewalls → Control zones: allowed conduit
- Control zones → Passive sensors: mirrored traffic
- Passive sensors → OT sensor console: assets and alerts
- OT sensor console → SIEM: alerts
- OT sensor console → CMDB: assets
- SIEM → SOC playbooks: triage
How we run it, phase by phase.
5 phases take you from Flat plant networks with no current OT inventory to Monitored zones and conduits (Claroty, Nozomi, Dragos). Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Site walk and switch trace
Walk each pilot site with a controls engineer, trace switch topology per Purdue level and choose SPAN or TAP points. Measure switch load before mirroring anything.
- phase 02
Passive inventory and baseline
Put the sensors and a central console in. Let the baseline cover one ordinary production week and one maintenance window, then sit with plant staff and go through each alert.
- phase 03
Zones and conduits
Group assets into zones and conduits following IEC 62443-3-2 and set target security levels with your engineers. Then write the firewall rules that actually enforce the conduits.
- phase 04
Remote access and accounts
Put vendor and engineer access through one brokered, recorded path with MFA. Find the shared and default accounts on field equipment, and put controls around the ones that can't be changed.
- phase 05
SOC integration
Alerts go to the SIEM, assets to the CMDB. Write playbooks that tell analysts when to call the plant instead of isolating a host that runs the process.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
Every pilot site has a current asset inventory
Controllers, HMIs and other assets are listed by passive sensors and a central console, with protocols and communication paths. We baselined them through a normal production week and a maintenance window.
- result 02
Zones and conduits are enforced by firewall rules
Zones and conduits follow IEC 62443-3-2. Target security levels were set with the operator's engineers, and firewall rules were written to match.
- result 03
Vendor access goes through one recorded path with MFA
Vendors and engineers get one brokered way in, with MFA and session recording. We inventoried the shared and default accounts on field equipment and brought them under control.
- result 04
SOC analysts know when to call the plant
OT alerts land in the SIEM, assets in the CMDB. Playbooks tell analysts when to call the plant rather than isolate a host that runs the process.
- result 05
Alerts are tuned with plant staff
Plant staff went through every baseline alert with us. What's left are alerts operators recognize and will act on.
Risks we plan for
-
Sensors in the wrong place
One sensor on the plant core switch misses traffic that stays inside cell switches. Placement follows the switch trace, not the org chart.
-
SPAN load on old switches
Older managed switches can choke when you mirror traffic off them. Where load is high, we plan TAPs or staged mirroring.
-
Active scanning near controllers
Some field devices fall over when you poll them. So active queries stay off unless plant engineers sign off on the scope and timing.
-
Baselines nobody tunes
Untuned alerts get ignored within weeks. Tuning is part of the work, with plant staff in the review.
Where AI helps, and where it needs guardrails
Where an OT platform offers an AI assistant for alert triage or asset context, check what data leaves the site, and where it is processed, before turning it on. AI agents never get a write path into levels 0 to 2. At most, analysts get a read-only MCP tool over the asset inventory or historian data in the industrial DMZ, with its own identity and logs.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- plan01
Switch trace and SPAN/TAP plan per site
yours to keep - inventory02
OT asset inventory with protocols and communication paths
yours to keep - design03
IEC 62443 zone and conduit diagram with target security levels
yours to keep - design04
Vendor remote access design with session recording
yours to keep - runbook05
SOC playbooks for OT alerts
yours to keep
Platforms and services on this move
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01Does passive monitoring put the process at risk?
Passive sensors read mirrored traffic and send nothing to controllers. The risks are switch load on old hardware and active polling if you enable it, and we check both with plant engineers first.
02Claroty, Nozomi Networks or Dragos?
It depends on your control vendors' protocols, your site layout and who will run the platform. We test two on your own mirrored traffic at one site before you buy.
03Does this satisfy TSA or NERC CIP?
You get the inventory, segmentation, access control and monitoring evidence those rules ask for. Whether that meets a specific requirement is your compliance team's and your regulator's decision.
04How many sites can we do at once?
It depends on site size, travel and how much plant staff time is available. Most programs prove the pattern at one or two sites, then roll out the rest.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyNasdaq Calypso upgrade to V19
Upgrading Nasdaq Calypso to V19, with server consolidation, properties moved to the database, the WebUI and deployment changes tested on your own trades.
read the case study722c2654 - 01TSA: Security directives and emergency amendments (Pipeline-2021-02 series)tsa.gov ↗
- 02NERC: CIP-015-1 internal network security monitoringnerc.com ↗
- 03Davis Wright Tremaine: FERC Order No. 907 approves CIP-015-1 (Jul 2025)dwt.com ↗
- 04Nozomi Networks: Mitsubishi Electric completes acquisition (28 Jan 2026)nozominetworks.com ↗
- 05ISA: ISA/IEC 62443 series of standardsisa.org ↗
- 06NIST SP 800-82 Rev. 3: Guide to OT Securitycsrc.nist.gov ↗
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it