- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing renaissance — driven by the Production Linked Incentive (PLI) scheme, Make in India initiatives, and rapid Industry 4.0 adoption — is connecting operational technology (OT) environments that were once deliberately isolated. Programmable logic controllers (PLCs), SCADA systems, distributed control systems (DCS), and industrial IoT sensors are being linked to enterprise networks for analytics, remote maintenance, and supply-chain integration. The result: an attack surface that did not meaningfully exist five years ago is now among the most consequential in the country.
For Indian CISOs and plant managers, the challenge is not theoretical. Threat actors — ranging from nation-state groups to financially motivated ransomware crews — have demonstrated both the interest and the capability to target industrial control systems. Understanding the landscape, the compliance obligations, and the practical defences available is now a board-level conversation.
OT environments were engineered for availability and determinism, not for confidentiality or even integrity in the IT sense. A PLC running a stamping press cannot tolerate a five-second patch reboot the way a web server can. Legacy protocols — Modbus, DNP3, PROFIBUS, BACnet — carry no authentication. Engineers expected these networks to be physically separated from the internet, a model sometimes called the “air gap.”
The air gap is largely a myth in modern operations. Remote vendor access, historian servers that bridge IT and OT, USB-based software updates, and cloud-connected SCADA dashboards have punched holes through the imagined barrier. What remains is an environment with:
For India specifically, the stakes include not just financial loss but potential disruption to critical national infrastructure — power plants, water treatment, pharmaceutical manufacturing, defence supply chains, and petrochemical facilities.
Several documented attack patterns are directly relevant to Indian operations:
The most common path: threat actors compromise an IT system (often through phishing or a vulnerable internet-facing server), move laterally across the flat IT/OT network, and either encrypt OT engineering workstations or reach the historian server that feeds the SCADA. Even without directly manipulating the PLC, shutting down the historian can force a plant to halt production — the effect is the same as attacking the OT directly. Indian manufacturing SMEs that run integrated SAP-SCADA environments on flat networks are particularly exposed.
Engineering workstations — the Windows machines that run Siemens TIA Portal, Rockwell Studio 5000, or Honeywell Experion — are often trusted implicitly by the OT network. Once an attacker lands on these machines, they can push ladder-logic changes, modify set-points, or disable alarms without triggering traditional IT security controls. Standard EDR tools often cannot be installed on these machines due to vendor support constraints.
OEM vendors frequently maintain persistent VPN or remote desktop access for maintenance. When those credentials are weak, shared, or unmonitored, they become a direct entry point. The Indian pharmaceutical sector — which has heavy foreign OEM dependencies — faces particular exposure here.
Publicly known vulnerabilities in widely deployed OT components — certain firmware versions of Modicon PLCs, specific Siemens S7 implementations — remain unpatched in many Indian plants simply because the patch process requires coordination with the OEM, a planned shutdown, and extensive testing. Threat actors actively scan for these exposed services.
Indian OT operators are subject to a tightening compliance landscape:
The Information Technology (Amendment) Rules 2022 require any “service provider, intermediary, data centre, body corporate, and government organisation” to report certain cybersecurity incidents to CERT-In within six hours of becoming aware. For OT environments, this means that a detected intrusion into the SCADA or historian — even if production was not disrupted — may trigger this obligation. Six hours is an extremely tight window when the detection-to-awareness pipeline is manual.
The National Critical Information Infrastructure Protection Centre (NCIIPC) designates sectors including power, oil and gas, telecom, and certain manufacturing segments as “critical information infrastructure.” Operators within these designations face additional guidelines around network segmentation, access controls, and incident reporting. NCIIPC advisories increasingly reference OT-specific threats.
The Digital Personal Data Protection Act, 2023 (DPDP Act) primarily governs personal data, but OT environments that collect worker biometrics, safety-monitoring data tied to individuals, or video surveillance footage of employees are data fiduciaries for that data. Breach notification obligations under the DPDP Act can therefore extend into the OT perimeter.
The Purdue Model remains a useful reference architecture, even as it evolves. The goal is progressive isolation combined with genuine visibility:
A dedicated OT DMZ — implemented with a next-generation firewall such as FortiGate in OT-aware mode — mediates all traffic between the enterprise IT network and the OT network. Historian servers sit in the DMZ, not on the OT network directly. Firewall policies enforce unidirectional or tightly scoped bidirectional flows. This single control eliminates the most common lateral-movement path from IT ransomware into the control network.
Before you can protect it, you must know it exists. Passive network taps on OT network segments — combined with deep-packet inspection that understands Modbus, DNP3, EtherNet/IP, and other industrial protocols — build an asset inventory without sending active probes that could destabilise sensitive control systems. Solutions integrated with FortiGate or the PrahiX Ora platform can correlate these assets against known vulnerability databases.
All vendor and remote-maintenance access should transit a Privileged Access Workstation (PAW) or secure remote-access gateway with MFA, session recording, and just-in-time provisioning. Persistent, always-on VPN tunnels for OEM vendors should be eliminated. Zero-trust network access (ZTNA) principles — verify the identity, the device posture, and the specific resource being accessed — apply as much to OT as to IT.
Standard SIEM use cases built for IT traffic — failed logins, brute-force patterns, lateral movement signatures — do not cover OT-specific behaviours such as unauthorised PLC firmware writes, unexpected changes to set-points, or unusual Modbus function-code sequences. OT security requires correlation rules mapped to ICS-specific MITRE ATT&CK for ICS tactics and techniques.
Responding to an OT incident is categorically different from an IT incident. Isolating an infected node could trip a safety interlock. The incident response playbook must specify who from the plant’s operations and safety teams must be in the decision loop before any network action is taken, and what the safe manual fallback procedure is for each critical process. CERT-In’s six-hour reporting window makes this pre-planning mandatory, not optional.
Managing an OT security programme requires sustained, 24/7 operational capability — not a one-time deployment. PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd, and PJ Networks is its primary field deployment and operations partner. We deploy and operate PrahiX Ora for clients where converged IT/OT visibility and response are required. The platform’s four pillars address exactly the gaps that make OT environments hard to defend.
SIEM with MITRE ATT&CK mapping. PrahiX Ora ingests logs from IT and OT sources — FortiGate firewalls, historian servers, Windows engineering workstations, and OT-capable network taps — correlating events against MITRE ATT&CK for Enterprise and ATT&CK for ICS simultaneously. Graph-based attack storyline reconstruction connects a phishing email landing on a corporate workstation to a subsequent suspicious Modbus write on the control network — a causal chain that silo’d tools miss. For Indian operators, Ora’s tiered log retention (hot/cold/archive) directly supports CERT-In’s direction on 180-day in-country log retention, keeping all evidence on Indian infrastructure.
NMS for converged visibility. In multi-site manufacturing estates, the NOC team often has separate dashboards for the IT network, the WAN links, the plant-floor switches, and the wireless APs — none of which shows the complete picture when an incident crosses boundaries. PrahiX Ora’s Network Management System (NMS) provides unified observability across firewalls, switches, APs, SD-WAN links, and OT network segments via LLDP/CDP topology discovery and network path tracing. ML-based anomaly detection flags unusual traffic patterns — such as a historian server initiating connections to external IPs — that rule-based tools miss.
Video surveillance (VMS) integration. For manufacturing, retail, and multi-site operations, physical security and cyber security are increasingly interdependent. Ora’s video surveillance (VMS) module manages ONVIF, Hikvision, and Dahua cameras with video analytics, placing physical access monitoring under the same operations view as the network. An after-hours physical intrusion correlated with a simultaneous anomalous VPN login is a signal that neither a camera system nor a firewall log would surface alone.
SOAR for the CERT-In six-hour window. The most critical benefit of automation in an OT context is speed. Ora’s SOAR layer includes pre-built playbooks with connectors that can push blocklists to FortiGate, quarantine compromised workstations, and generate a structured incident timeline — automatically. When the clock starts at detection and CERT-In requires notification in six hours, automated orchestration is what makes that timeline achievable without cutting corners on accuracy. For OT incidents, playbooks are configurable to require human approval before any network action is taken on OT segments, preserving safety while accelerating the reporting pipeline.
If your organisation is building out a converged IT/OT security operations capability, we can walk you through how Ora is deployed and tuned for industrial environments.
Given the constraint of live production environments, a phased approach is realistic:
OT security in Indian manufacturing is transitioning from a niche concern to a mainstream risk management imperative. Threat actors have demonstrated that industrial systems are viable targets. CERT-In’s reporting obligations and NCIIPC guidance create compliance pressure alongside the operational risk. The combination of converged IT/OT networks and long-lived, unpatched OT assets creates a wide attack surface that will not close on its own.
The good news is that a structured, phased programme — starting with visibility and segmentation — delivers significant risk reduction without requiring a production shutdown. The organisations that act now, before an incident forces the issue, will be considerably better positioned than those that wait.
PJ Networks provides OT security assessments, FortiGate-based OT network segmentation, and 24/7 managed SOC coverage for converged IT/OT environments across India. We operate PrahiX Ora as the platform layer for clients requiring unified SecOps. To discuss your OT security posture, contact our team at pjnetworks.com/contact.