- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing sector is undergoing a rapid digital transformation. Assembly lines once driven by purely mechanical processes now rely on programmable logic controllers (PLCs), SCADA systems, industrial IoT sensors, and cloud-connected dashboards. In energy, utilities, and pharmaceuticals, similar stories play out: operational technology (OT) that was once air-gapped is now networked, often sharing infrastructure with corporate IT. That convergence is a productivity revolution. It is also a security catastrophe waiting to happen — and in many organisations, it has already arrived.
This guide is for Indian enterprise CISOs, plant managers, and IT security leaders who need a clear, actionable framework for OT/ICS cyber security. We cover the current threat landscape, why traditional IT controls fall short in OT environments, the architecture of a defensible OT network, and the compliance obligations every Indian critical-sector company must meet under CERT-In’s 2022 directions.
For decades, the prevailing assumption in industrial security was that physical separation — the air gap — was sufficient protection. Attacks on industrial control systems existed in theory and in the occasional headline, but they felt distant, targeted at foreign state-owned utilities or defence facilities. That assumption has been shattered.
In 2025 and into 2026, the India Computer Emergency Response Team (CERT-In) has issued multiple advisories specifically referencing threats to industrial control systems across the power, oil and gas, water treatment, and pharmaceutical sectors. Threat intelligence from Fortinet’s FortiGuard Labs and global OT security researchers documents a sharp increase in ransomware operators deliberately targeting OT networks, knowing that shutting down a production line or disrupting a utility creates enormous pressure to pay quickly.
Three dynamics are driving the escalation:
For Indian enterprises, the consequences are concrete: regulatory penalties under the IT Act and CERT-In directions, potential liability under the Digital Personal Data Protection (DPDP) Act if operational data processing is disrupted, loss of production revenue, and — in critical infrastructure — potential public safety consequences.
If your organisation has deployed next-generation firewalls, endpoint detection, and a SOC for the corporate network, you might assume the same tools can simply be extended to the plant floor. That assumption leads to dangerous gaps.
In IT security, the CIA triad (Confidentiality, Integrity, Availability) is balanced. In OT, availability is paramount. A two-minute patch reboot that your SOC would consider trivial may represent thousands of units of lost production or, worse, an unsafe equipment state. This means OT systems often cannot be patched on the same cadence as IT systems, and any security control that risks interrupting a process is viewed as unacceptable by operations teams.
Industrial control networks speak protocols your IT firewall may never have encountered: Modbus, DNP3, IEC 61850, PROFINET, EtherNet/IP, OPC-UA. A security platform that cannot parse and inspect these protocols will see only encrypted or opaque traffic and miss lateral movement entirely. NGFW policies built for HTTP, TLS, and DNS inspection provide no meaningful coverage for a Modbus command injection attack.
Endpoint detection and response (EDR) agents run on general-purpose operating systems. A PLC is firmware. A historian server may run an OS version that no longer supports modern agents. Visibility in OT environments must therefore come from the network layer — passive traffic monitoring, protocol-aware inspection, and anomaly detection rather than host-based telemetry.
OT equipment vendors release firmware updates infrequently, often require on-site vendor involvement to apply them, and sometimes void support agreements if patches are applied independently. Vulnerability management processes that assume monthly patching windows simply cannot be transplanted into OT without significant re-engineering.
Understanding how attackers enter OT networks is the first step to closing those pathways. The following vectors account for the majority of confirmed OT incidents:
Most OT breaches begin in the IT network. A phishing email delivers malware to a corporate workstation. The attacker establishes persistence, maps the network, discovers that the engineering workstation — used to programme PLCs — is reachable from the corporate VLAN, and pivots. From the engineering workstation, they can push malicious ladder logic or firmware to PLCs with little resistance.
Vendors frequently require remote access to OT equipment for maintenance. VPN tunnels or RDP sessions established for vendor access are often left open continuously, protected by weak credentials or shared passwords. Attackers compromise vendor systems or credential dumps and use those pathways directly into OT.
USB drives remain a primary infection vector in air-gapped or semi-isolated OT environments. Compromised software updates from equipment vendors — a supply chain attack — are harder to detect and have been used in sophisticated campaigns targeting industrial targets globally.
HMI (Human-Machine Interface) panels and SCADA web interfaces are sometimes exposed to the internet without authentication or with default credentials. Shodan scans routinely discover thousands of such systems; attackers treat them as persistent footholds.
A defensible OT security posture rests on five pillars. These are not aspirational — they can be implemented incrementally, beginning with the highest-risk areas.
You cannot protect what you cannot see. Begin with a complete passive inventory of all devices on OT network segments: PLCs, RTUs, HMIs, historians, engineering workstations, network switches, and any device with an IP address. Passive discovery (listening to network traffic rather than actively scanning) is essential to avoid disrupting sensitive equipment. Classify each asset by criticality: loss of this device for one hour means what — production pause, safety risk, regulatory breach?
OT networks should be organised into zones and conduits, as described in IEC 62443. The enterprise IT network, the OT demilitarised zone (DMZ), and individual cell/process networks should be separated by firewalls — not simple ACLs on managed switches. Traffic permitted between zones should be explicitly whitelisted by protocol and direction; everything else should be denied by default.
Replace always-on VPN tunnels with time-limited, audited, least-privilege access for both internal engineers and external vendors. Zero Trust Network Access (ZTNA) principles — verify identity, verify device posture, grant access only to the specific resource needed for the specific session duration — apply directly to OT vendor access management.
Deploy passive network monitoring capable of parsing OT protocols. Establish a baseline of normal communications — which engineering workstation normally talks to which PLC, which Modbus function codes are in regular use — and alert on deviations. Anomalous read/write commands to PLCs are a reliable indicator of reconnaissance or pre-attack activity.
Standard IT incident response playbooks assume you can isolate an affected system immediately. In OT, isolation may mean stopping a production line or triggering a safety interlock. OT incident response plans must be developed jointly with operations, define containment options that preserve safety, and include a tested runbook for CERT-In notification within the mandated six-hour window.
PJ Networks deploys FortiGate next-generation firewalls as the segmentation layer between IT and OT zones and between internal OT segments. FortiGate’s Industrial OT intrusion prevention signatures cover the major ICS protocols and can detect anomalous Modbus, DNP3, and PROFINET traffic without requiring changes to OT device configurations.
At the IT/OT boundary, FortiGate enforces:
For organisations with multiple plants or geographically distributed OT sites, FortiGate SD-WAN provides encrypted connectivity between sites with consistent security policy enforcement — replacing legacy MPLS circuits without sacrificing the deterministic latency that process control networks require.
One of the hardest problems in OT security is the visibility gap between the IT SOC and the plant floor. Security analysts monitoring corporate IT have no line of sight into PLC communications or SCADA alarm states. Plant engineers watching HMI dashboards have no awareness of threat intelligence or lateral movement indicators from the IT network. This gap is exactly where sophisticated attackers operate — quietly, across organisational boundaries.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner. We deploy and operate the platform for clients across manufacturing, retail, BFSI, and multi-site enterprise environments. Ora addresses the IT/OT visibility gap across four integrated pillars:
SIEM — Correlated Threat Detection Across IT and OT Sources: Ora’s SIEM ingests logs and events from FortiGate firewalls, corporate Active Directory, EDR platforms, and OT-facing sources including historian databases, SCADA alarm logs, and network tap data. Correlation rules are mapped to MITRE ATT&CK for ICS (a dedicated framework covering OT-specific adversary techniques), enabling analysts to see attack progression across the IT/OT boundary as a connected storyline rather than isolated alerts. For Indian enterprises, a critical capability is Ora’s tiered log retention — hot, warm, and archive tiers — which supports CERT-In’s direction on 180-day in-country log retention without requiring organisations to build and manage their own log infrastructure.
NMS — Unified Observability Across Enterprise and OT Networks: In multi-site manufacturing estates, NOC visibility is almost always fragmented: IT network management tools cannot discover OT devices; OT monitoring tools do not cover enterprise WAN links or cloud connectivity. Ora’s Network Management System uses LLDP/CDP topology discovery alongside OT-appropriate passive methods to build a unified topology map spanning FortiGate firewalls, managed switches, wireless APs, SD-WAN links, and OT network segments. ML-based anomaly detection identifies unusual traffic patterns — for example, a historian that suddenly begins initiating outbound connections, or a PLC that starts communicating with a new IP — and triggers alerts before the behaviour escalates into an incident.
Video Surveillance (VMS) — Physical and Cyber Security Under One Operations View: Physical access to plant floor equipment is a direct path to OT compromise — an insider or contractor with physical access to a PLC can modify firmware without touching the network. Ora’s video surveillance module manages ONVIF, Hikvision, and Dahua camera feeds with video analytics for motion detection, zone intrusion, and access event correlation. For manufacturing and multi-site retail estates, this means physical security events — a badge bypass at a server room door, unauthorised access to a control cabinet — are visible in the same operations console as network security alerts, enabling faster correlation and response.
SOAR — Automated Response Within CERT-In’s 6-Hour Window: CERT-In’s 2022 directions require reporting of incidents — including ransomware, unauthorised OT access, and data breaches — within six hours of detection. Without automation, that timeline is unrealistic: manual alert triage, escalation approvals, and containment actions in a complex IT/OT environment routinely take longer. Ora’s SOAR engine provides pre-built playbooks for the most common OT incident types, with automated response actions including pushing blocklists to FortiGate, isolating compromised segments at the firewall level, and generating the initial incident notification draft aligned to CERT-In’s reporting format. Automation does not eliminate human judgement — it accelerates the mechanical steps so that analysts can focus on the decisions that require expertise, and the six-hour window becomes achievable rather than aspirational.
If your SOC is currently operating without unified IT/OT visibility, or if CERT-In compliance reporting is a manual, stressful process after every incident, Ora’s integrated approach is worth exploring. Contact PJ Networks for a demonstration in your environment.
OT environments do not follow business hours. Manufacturing plants run three shifts. Utilities operate continuously. A ransomware operator targeting a factory will deliberately execute the final payload at 2 a.m. on a Friday, knowing that the security team is at minimum staffing and that weekend downtime is maximally expensive.
PJ Networks operates a 24/7 NOC/SOC staffed by analysts experienced in both IT security and OT environments. Our monitoring service for OT-integrated clients covers:
India’s CERT-In directions, issued under Section 70B of the IT Act 2000, carry specific obligations for critical sectors including power, telecom, finance, and manufacturing of strategic goods. The six-hour reporting requirement applies to a defined list of incident types — and that list explicitly includes attacks on critical information infrastructure, ransomware infections affecting operational systems, and unauthorised access to industrial control systems.
Non-compliance is not a theoretical risk. CERT-In has issued notices and conducted follow-up investigations with organisations that failed to report in time. The penalties under the IT Act, combined with the reputational consequences of a delayed or incomplete notification, make compliance infrastructure — logging, detection, playbooks, and reporting tooling — a business necessity, not a regulatory checkbox.
The specific obligations for OT-operating enterprises to address:
Transforming OT security posture does not require a multi-year programme. A focused 90-day engagement can close the most critical gaps:
Each phase is designed to deliver standalone value — the asset inventory is useful even if budget constraints delay the firewall deployment. Progress compounds: a well-segmented network with a monitored perimeter is dramatically harder to attack than a flat network with no visibility, even before advanced analytics are fully configured.
The convergence of IT and OT is irreversible — the efficiency gains are too significant to abandon. The security consequences of that convergence are equally real. Indian manufacturers, utilities, and critical infrastructure operators are being actively targeted by ransomware operators and nation-state actors who have developed specific tools for ICS environments.
The good news is that a defensible OT security posture is achievable. The combination of FortiGate NGFW segmentation, ZTNA-controlled access, and unified SecOps visibility through PrahiX Ora gives Indian enterprises the technical foundation. PJ Networks’ 24/7 NOC/SOC provides the operational layer that ensures that foundation is actually monitored, tuned, and ready to respond when an attack materialises — and meet CERT-In’s six-hour notification window without heroics.
If you are responsible for operational technology security in an Indian enterprise and would like an honest assessment of your current exposure and a practical path to improvement, contact PJ Networks. We offer OT security assessments, phased deployment programmes, and managed SOC services designed for the realities of Indian manufacturing and critical infrastructure environments.