Segmenting IT/OT networks after a near-miss ransomware event
Following a ransomware infection that nearly reached production line PLCs, Brangus IT designed and implemented an IT/OT segmentation architecture across six manufacturing plants without a single minute of unplanned downtime.
The Problem
A ransomware infection on a corporate laptop spread to within one network hop of the plant floor's programmable logic controllers before being manually disconnected by an alert operator — a near-miss that triggered an executive mandate for architectural change.
Our Assessment
Our assessment found flat network architecture connecting corporate IT directly to OT environments across all six plants, with no consistent segmentation, monitoring, or access control between the two domains.
The Solution
We designed a Purdue-model-aligned segmentation architecture with dedicated DMZs between IT and OT zones, deployed passive OT monitoring for visibility without touching sensitive control systems, and implemented identity-based access controls for remote vendor connections.
Implementation
Implementation was phased plant-by-plant during scheduled maintenance windows over 5 months, with passive monitoring deployed first to validate traffic patterns before any firewall policy enforcement.
Results
- IT/OT segmentation completed across all 6 plants
- Zero unplanned production downtime during implementation
- Full OT asset visibility achieved for the first time company-wide
- Remote vendor access moved to just-in-time, logged, identity-based sessions
Business Impact
The manufacturer eliminated its single largest operational risk exposure and gained the OT visibility needed to support a subsequent cyber-insurance renewal at a materially lower premium.
Engagement Results
6
Plants segmented
12,400
OT assets discovered
0 minutes
Unplanned downtime
Facing a similar challenge?
Let's talk about what a comparable engagement would look like for your environment.