- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing sector is undergoing its most significant digital transformation in decades. Smart factories, Industry 4.0 automation, connected PLCs, SCADA systems, and remote monitoring dashboards have brought enormous efficiency gains — but they have also opened a sprawling, largely undefended attack surface that threat actors are actively exploiting.
Operational Technology (OT) and Industrial Control Systems (ICS) were never designed with cybersecurity in mind. They were built for availability, predictability, and long operational lifetimes — often 15 to 25 years. Many of the PLCs and SCADA nodes running India’s steel plants, pharma lines, food processing units, and auto-component factories today run on unpatched firmware, legacy Windows versions, and flat network architectures that give any attacker who enters the perimeter unrestricted lateral movement.
This is no longer a theoretical risk. Ransomware groups have explicitly targeted industrial environments globally, and India’s booming manufacturing sector makes it an attractive geography for both financially motivated cybercriminals and state-aligned actors probing critical infrastructure.
Most enterprise IT security programs are built around the CIA triad with an availability-last posture: confidentiality and integrity take priority, and a patch-on-Tuesday cadence is considered normal. OT flips this entirely.
In an industrial environment, an unplanned shutdown is a financial catastrophe. Taking a PLC offline for patching might require scheduling a production window weeks in advance. Pushing an untested firmware update to a conveyor controller could trigger cascading failures. Applying an endpoint agent to a 10-year-old HMI running Windows XP Embedded could cause it to stop responding entirely.
This creates a fundamental tension: the security tools and processes that work in IT environments can actively harm OT environments. And yet, the convergence of IT and OT networks — driven by remote access requirements, cloud-connected SCADA, and enterprise MES/ERP integrations — means that an attacker who compromises the IT perimeter now has a path into the shop floor.
India’s regulatory environment is tightening significantly. CERT-In’s April 2022 directives — now enforced — require all organisations in critical sectors, including manufacturing and process industries, to report cybersecurity incidents to CERT-In within six hours of detection. This is a remarkably tight window, and it applies equally to OT incidents: a ransomware attack on a manufacturing execution system, a denial-of-service event on a SCADA network, or unauthorized access to a DCS historian all qualify.
The CERT-In directives also mandate log retention of at least 180 days and the logs must be maintained within India. Many OT environments generate event logs from historians, SCADA servers, and network devices that are either never retained or exported to offshore cloud infrastructure — both of which create compliance gaps.
The Digital Personal Data Protection Act (DPDP Act) 2023 adds another layer. Manufacturing and process environments increasingly collect worker biometrics, visitor data via CCTV, and operator identity through MES systems. Under DPDP, this personal data must be handled with defined purpose limitation, retention policies, and breach notification obligations. An OT breach that exposes worker data — operator login records, biometric access logs — could trigger DPDP notification requirements on top of CERT-In reporting.
Securing OT environments requires a different playbook from standard IT security. The following phased approach works for Indian manufacturing organisations ranging from single-site SMEs to multi-plant conglomerates.
You cannot protect what you cannot see. The first priority is passive OT asset discovery — deploying passive network monitoring that identifies every device on the OT network without sending any active probes that could disrupt production. Tools that support passive discovery using protocols like Modbus, DNP3, EtherNet/IP, and OPC-UA can map your asset estate within days.
Every identified device should be catalogued with: make and model, firmware version, open services, network connections, and owner (internal operations vs. third-party integrator). This inventory becomes the foundation for vulnerability prioritisation and network segmentation decisions.
The Purdue Enterprise Reference Architecture remains the practical gold standard for OT network segmentation. The key boundaries to enforce:
All third-party remote access to OT environments should transit through a managed jump server or privileged access workstation with session recording. ZTNA principles apply here: no vendor should have persistent, always-on access. Access should be granted per-session, per-purpose, with full audit trails.
Vendor accounts should be reviewed quarterly. Accounts from integrators who completed their engagement should be disabled or deleted. Shared credentials — the norm in most OT environments — should be eliminated in favour of individual named accounts.
Standard IT SIEM tools do not understand Modbus function codes, DNP3 object types, or EtherNet/IP CIP commands. Effective OT threat detection requires correlation rules that understand the semantics of industrial protocols. An unexpected “Force Coil” command on a Modbus bus, a firmware download to a PLC outside a maintenance window, or a SCADA historian receiving write commands from an unexpected source are all high-fidelity indicators of compromise in an OT context.
24/7 monitoring with OT-trained SOC analysts completes the picture. Most Indian manufacturing organisations do not have the in-house expertise to staff an OT SOC. This is where managed security partnerships become operationally essential.
Every OT environment needs an incident response plan that accounts for the industrial context. The plan must define: at what point does an OT incident trigger a production shutdown decision, who has authority to isolate a production segment, and what is the recovery sequence for restoring a compromised DCS to a known-good state. Tabletop exercises should simulate ransomware scenarios where the production floor is offline and the CERT-In 6-hour clock is running.
One of the persistent operational challenges in manufacturing security is the fragmentation of tooling: separate consoles for network monitoring, a separate SIEM for IT events, and no unified view of what is happening across the OT floor and the enterprise network simultaneously. This is precisely the problem that PrahiX Ora addresses.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner, and we deploy and operate the platform for clients across manufacturing, healthcare, and multi-site enterprise environments. The four converged pillars of Ora each address a distinct but interconnected security operations need.
SIEM — Correlation with MITRE ATT&CK Coverage: Ora’s SIEM ingests logs from IT and OT sources — FortiGate firewalls, SCADA historians, Windows event logs, network switches — and applies correlation rules mapped to the MITRE ATT&CK for ICS framework. When a sequence of events matches a known attack pattern, Ora reconstructs the full attack storyline using graph-based analysis, giving SOC analysts a coherent narrative rather than a flood of individual alerts. Critically, Ora’s tiered log retention (hot/cold/archive) is designed to keep 180 days of logs available in-country, directly supporting CERT-In’s log retention direction without requiring a separate compliance infrastructure.
NMS — Unified Network Observability: In multi-vendor manufacturing estates — FortiGate firewalls, Cisco switches, multiple WAN and SD-WAN links, wireless APs — NOC visibility is typically fragmented across vendor-specific management consoles. Ora’s NMS provides a single pane of glass with LLDP/CDP topology discovery, network path tracing, and ML-based anomaly detection with auto-healing policies. For OT environments, this means a NOC operator can see a latency spike on the production VLAN, identify the affected segment on the topology map, and trigger a remediation action — all without switching between multiple management tools.
Video Surveillance (VMS) — Physical and Network Security Converged: For manufacturing, retail, and multi-site estates, physical security and network security have traditionally been operated by different teams with no shared context. Ora’s video surveillance (VMS) module supports ONVIF, Hikvision, and Dahua camera management with integrated video analytics. A tailgating event at a server room or production floor access point can be correlated with network access events in the same timeline, giving security operations a genuinely converged view. For facilities where physical access to OT hardware — swapping a USB drive, connecting a rogue device to the process network — represents a primary threat vector, this convergence has direct security value.
SOAR — Automated Response Within the CERT-In Window: CERT-In’s 6-hour incident reporting window is achievable only with automation. Ora’s SOAR module provides pre-built connectors and automated response actions — including pushing blocklists directly to FortiGate firewalls. When a confirmed indicator of compromise is identified, the platform can automatically isolate the affected network segment, trigger an evidence preservation workflow, and populate a draft incident report, all within minutes of detection. Human review happens within the response workflow, not before it starts — which is what makes the 6-hour window realistic rather than aspirational.
For manufacturing organisations evaluating how to address OT security and compliance obligations, we recommend starting with an assessment conversation. Ora platform deployments typically begin with a 2-week visibility exercise that maps the asset estate and identifies the highest-priority gaps before any changes are made to production infrastructure.
At the network perimeter of OT environments, not all next-generation firewalls are equal. FortiGate’s OT Security Service includes deep packet inspection for industrial protocols — Modbus, DNP3, EtherNet/IP, IEC 61850, OPC-UA — which means the firewall can enforce application-layer policies that understand what commands are and are not legitimate for a given production context. An unexpected “Write Multiple Registers” on a Modbus bus to a PLC that should only receive read requests becomes a detectable and blockable event.
FortiGate ruggedised appliances are rated for the temperature, humidity, and vibration profiles of industrial environments. They can be deployed in the OT DMZ or at the boundary between production VLANs without requiring a climate-controlled equipment room.
PJ Networks’ 24/7 NOC/SOC team manages FortiGate deployments across both IT and OT environments, with SOC analysts trained to recognise OT-specific threat patterns and escalation procedures calibrated to the production-first sensitivity of industrial clients.
Use this checklist to assess your organisation’s current OT security posture against regulatory and best-practice requirements:
PJ Networks is an Indian managed security provider with deep expertise in FortiGate/Fortinet deployments, 24/7 NOC and SOC operations, ZTNA implementations, SD-WAN, FortiMail, and MSSP engagements for enterprise and mid-market clients across India.
Our OT security practice combines network segmentation engineering using FortiGate with OT Security Service, passive asset discovery, and round-the-clock monitoring through our integrated SOC and the PrahiX Ora unified SecOps platform. We understand the production-first constraints of industrial environments and build security programmes that protect the shop floor without disrupting it.
If your manufacturing organisation is ready to move beyond perimeter-only IT security and build genuine OT visibility and protection, we would welcome a conversation. The first step is typically a no-obligation assessment that maps your current OT network architecture, identifies your highest-risk gaps, and outlines a prioritised roadmap that accounts for your production schedules and operational constraints.
Contact PJ Networks to schedule your OT security assessment at pjnetworks.com.