- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing sector is undergoing a profound digital transformation. Smart factories, Industry 4.0 automation, and connected supply chains are driving productivity gains — but they are simultaneously expanding the attack surface in ways that traditional IT security teams are ill-equipped to handle. Operational Technology (OT) and Industrial Control Systems (ICS) — the backbone of production lines, power grids, water treatment plants, and logistics facilities across India — were designed for reliability, not security. Today, they are prime targets for nation-state actors, ransomware groups, and organised cybercriminals.
This guide is for Indian enterprise IT leaders and CISOs responsible for both IT and OT environments. We’ll walk through the threat landscape, the architectural gaps that put production at risk, and the practical steps you can take — including how managed security services, next-generation firewalls, and unified SecOps platforms can significantly harden your industrial estate.
For decades, OT networks operated in isolation — air-gapped from corporate IT, unknown to the internet. That separation has evaporated. Digital integration between ERP systems and plant-floor SCADA, remote access for vendor maintenance, cloud-connected HMIs, and the adoption of commodity IT hardware in OT environments have collapsed the boundary between IT and OT.
The consequences are severe:
India’s manufacturing sector — automotive, pharmaceuticals, textiles, electronics assembly, and FMCG — is a high-value target. Threat actors understand that production disruption forces faster ransomware payouts than data theft alone.
Ransomware operators have learned that OT environments are softer targets than hardened IT infrastructure. Legacy Windows XP or Windows 7 HMI stations that cannot be patched, long maintenance windows that delay updates, and flat network architectures that allow lateral movement — all of these make OT networks attractive. Threat groups now deploy OT-aware variants that specifically target Siemens S7, Rockwell ControlLogix, and Schneider Electric PLC protocols.
Attackers increasingly use legitimate remote access tools — VNC, TeamViewer, or vendor-supplied remote desktop clients — that OT teams have whitelisted for maintenance. Once inside, they move slowly and quietly, mapping the environment for weeks before executing a destructive payload. Traditional endpoint detection tools either aren’t deployed on OT workstations or generate too much noise to be actionable.
Many Indian manufacturers grant persistent VPN or RDP access to OEM vendors and system integrators for remote maintenance. These third-party connections are rarely audited, often over-privileged, and sometimes share credentials across multiple customer environments. A compromise at the vendor level can propagate to dozens of facilities simultaneously.
The most common attack pattern involves an initial compromise in the corporate IT network — through phishing, a vulnerable internet-facing service, or a credential breach — followed by lateral movement into the OT segment through poorly secured IT/OT junctions. Engineering workstations that sit on both networks, shared file servers, and historian systems are typical pivot points.
Before prescribing solutions, it helps to understand where most Indian OT environments fall short:
The Purdue Enterprise Reference Architecture (PERA) divides OT networks into discrete zones — enterprise (Level 4/5), DMZ, supervisory (Level 3), control (Level 2), and field devices (Level 0/1). While no architecture is perfect for every plant, the key principle is enforced zone isolation: devices in one zone should not communicate directly with devices in another zone without passing through a security inspection point.
FortiGate Next-Generation Firewalls are well-suited to this role because they support deep packet inspection of OT protocols including Modbus TCP, DNP3, and IEC 61850. Rather than treating OT traffic as opaque streams, FortiGate can parse command structures, detect anomalous commands (e.g., a firmware write to a PLC outside a maintenance window), and enforce allow-listed OT communication patterns.
Replace persistent VPN tunnels to OT vendors with Zero Trust Network Access (ZTNA) sessions. ZTNA enforces the principle of least privilege for every connection: a vendor engineer is granted access only to the specific historian or HMI they need, for a specific time window, from a verified device. Every session is logged. FortiGate’s ZTNA capabilities, combined with FortiClient and FortiAuthenticator for MFA enforcement, provide a robust foundation for secure vendor access without the sprawl of traditional VPN infrastructure.
You cannot protect what you cannot see. Passive network discovery tools — which listen to OT traffic without actively probing devices (active probing can crash sensitive PLCs) — can build a real-time inventory of OT assets, firmware versions, and active communication patterns. This inventory is the foundation for vulnerability management: knowing which controllers are running firmware with known CVEs and prioritising compensating controls where patching isn’t feasible.
OT security events — unexpected Modbus function codes, failed authentication to engineering workstations, unusual data transfers from historians to external IPs — must be correlated with IT security events to reconstruct the full attack chain. This requires a SIEM that ingests both IT and OT log sources and has correlation rules tuned for industrial attack patterns.
OT incident response is fundamentally different from IT incident response. Isolating a compromised server is straightforward; isolating a compromised PLC that controls a running production line is not. OT incident response plans must define production-safe isolation procedures, fallback to manual operations where feasible, and communication protocols with plant safety officers. CERT-In’s six-hour reporting window adds urgency — teams that haven’t rehearsed OT IR will struggle to meet that timeline while simultaneously managing a production crisis.
One of the persistent challenges in OT security is visibility fragmentation. The IT SOC monitors corporate infrastructure; the OT team monitors plant floor operations; and the connection between the two — the IT/OT DMZ where attackers love to hide — is often nobody’s responsibility. This is the gap that PrahiX Ora, a unified SecOps platform built by PrahiX Tech Pvt Ltd, is designed to close.
PJ Networks is PrahiX Ora’s primary field deployment and operations partner. We deploy and operate the platform for clients across manufacturing, logistics, and critical infrastructure — giving their IT and OT teams a single operational view instead of siloed dashboards.
SIEM: Ora’s SIEM ingests logs from OT historians, engineering workstations, FortiGate firewalls, AD domain controllers, and cloud workloads into a unified correlation engine. Attack storylines are reconstructed using graph-based analysis mapped to MITRE ATT&CK for ICS — so analysts see not just individual alerts but the full kill chain from initial access through lateral movement to execution. With tiered hot/cold/archive retention, the platform supports CERT-In’s direction on 180-day in-country log retention — particularly relevant for manufacturers classified as critical information infrastructure operators.
NMS (Network Management System): Ora’s NMS provides unified observability across FortiGate firewalls, switches, wireless APs, WAN and SD-WAN links — including assets in OT DMZs and plant-floor network segments. LLDP/CDP topology discovery builds a live map of your estate, and ML-based anomaly detection flags traffic pattern deviations that manual monitoring would miss. For large multi-site manufacturers with fragmented NOC visibility across dozens of plants, this unified view is operationally transformative.
Video Surveillance (VMS): Ora’s video surveillance (VMS) module supports ONVIF, Hikvision, and Dahua camera management with video analytics — bringing physical security events into the same operational view as network and endpoint events. For manufacturing and retail estates with security cameras at entry points, warehouses, and production areas, correlating a physical intrusion alert with a simultaneous network anomaly in the same facility becomes possible within the platform, without switching between separate tools.
SOAR: The SOAR layer connects Ora’s detection capability to automated response. Pre-built connectors push blocklists and isolation policies directly to FortiGate — so when Ora detects a confirmed C2 communication from a plant-floor workstation, it can push a deny rule to the relevant FortiGate segment automatically, without waiting for a human analyst to manually intervene. For manufacturers facing CERT-In’s six-hour incident reporting requirement, this automation is what makes that timeline realistic — it compresses the detection-to-containment cycle and generates the evidence artefacts needed for regulatory notification.
If your organisation is managing a complex IT/OT estate without unified SecOps visibility, we are happy to walk through how the platform works in practice. Reach out to our team for a conversation.
Use this checklist as a starting point for an OT security programme review:
Indian manufacturers operating critical information infrastructure (CII) — including power generation, water, oil and gas, and certain large-scale manufacturing — fall under CERT-In’s mandatory incident reporting framework. The six-hour reporting window is demanding but achievable with the right detection and response infrastructure in place.
The DPDP Act (Digital Personal Data Protection Act) is primarily data-privacy legislation, but its breach notification requirements apply where OT systems process personal data — for instance, employee access control systems, biometric attendance, or customer-linked production tracking. Organisations should assess whether any OT systems touch personal data and ensure those systems are included in their data breach response planning.
Neither CERT-In compliance nor DPDP readiness can be achieved through a single product or service. They require a combination of architecture controls, operational processes, log retention, and tested incident response capabilities working together. PJ Networks helps Indian enterprises build and operate this combination — from FortiGate-based network segmentation and ZTNA to 24/7 SOC monitoring and managed detection and response.
OT security is not a one-time project — it is an ongoing operational discipline. PJ Networks brings together the technology (FortiGate NGFW, FortiClient ZTNA, FortiMail), the platform (PrahiX Ora for unified SecOps), and the 24/7 human expertise (NOC and SOC operations staffed around the clock) that manufacturing organisations need to sustain meaningful OT security posture over time.
Our managed security services are designed for Indian enterprise reality: multi-site estates, mixed-vintage OT equipment, lean in-house IT teams, and regulatory pressure that is only increasing. We don’t sell point products — we build and operate your security programme as a partner.
If you are beginning an OT security assessment or expanding an existing programme, we welcome the conversation. Contact PJ Networks to speak with our OT security specialists.