OT/ICS Cybersecurity for Indian Manufacturing: Bridging the IT-OT Gap Before Attackers Do

• 21 October, 2026
• No Comments

India’s manufacturing sector — spanning automotive, pharmaceuticals, chemicals, FMCG, and steel — is undergoing a rapid digital transformation. Industrial control systems that once operated in isolated air-gapped environments are now connected to corporate IT networks, cloud dashboards, and remote-access portals. The efficiency gains are real. So are the risks.

Operational Technology (OT) and Industrial Control Systems (ICS) were engineered for reliability and uptime, not security. Legacy PLCs, SCADA systems, and HMI panels run on protocols — Modbus, PROFINET, DNP3 — that were never designed with authentication or encryption in mind. When these systems are bridged to an enterprise IT network without proper segmentation, a single compromised laptop in the accounts department can become a launchpad for a plant-floor catastrophe.

This guide is for Indian enterprise IT leaders and CISOs who are responsible for both the corporate network and the shop floor — or who are beginning to realise that the boundary between the two has already dissolved.

Why OT/ICS Security Is Different — and Why That Matters for India

In classic IT security, the CIA triad — Confidentiality, Integrity, Availability — is usually prioritised in that order. In OT environments, the order inverts: Availability comes first. You cannot patch a PLC running a continuous chemical process the same way you push a Windows update. Downtime has physical consequences: spoiled pharmaceutical batches, halted assembly lines, or — in critical infrastructure — safety incidents.

Indian manufacturers face additional pressures:

• Multi-vendor complexity: A single plant may run Siemens SCADA, Allen-Bradley PLCs, Honeywell DCS, and a bespoke HMI from a local vendor — often on Windows XP or Windows 7 machines that cannot be patched.
• OEM remote access: Equipment suppliers routinely require always-on VPN connections for remote diagnostics. Each such connection is a potential entry point.
• Regulatory pressure: CERT-In’s 2022 directive requires critical infrastructure operators to report incidents within six hours. Many OT teams have no mechanism to even detect an incident, let alone report it in time.
• Supply chain exposure: Indian tier-1 automotive and pharma suppliers are often linked to global OEMs via EDI/B2B integrations — an IT pathway that passes directly adjacent to plant systems.

The Anatomy of an OT Attack: What Indian CISOs Must Understand

Threat actors targeting manufacturing environments rarely begin on the plant floor. The typical kill chain looks like this:

1. Initial access via IT: A phishing email, a vulnerable VPN appliance, or an exposed RDP session provides entry into the corporate network.
2. Lateral movement: The attacker moves through the IT network, seeking credentials, mapping shares, and eventually identifying OT-accessible jump servers or historian workstations.
3. IT-OT pivot: The attacker crosses into the OT network — often because there is no true segmentation, only a logical separation on the same VLAN.
4. Reconnaissance and persistence: Native OT protocols are used to enumerate controllers, manipulate set-points, or install backdoors in engineering workstations.
5. Impact: Ransomware encrypts the historian and HMIs (halting visibility into the plant), or worse, logic bombs alter process parameters to cause physical damage.

Well-known incidents such as the Triton/TRISIS malware attack on a petrochemical facility — which targeted safety instrumented systems — and the Oldsmar water treatment attack demonstrated that ICS attacks are no longer theoretical. Indian facilities are not exempt from this threat landscape.

Building the Right Architecture: IT-OT Segmentation That Actually Works

The Purdue Model (ISA/IEC 62443) remains the most widely referenced framework for OT network architecture. While not a silver bullet, its zone-and-conduit model provides a practical starting point:

• Level 0–2 (Plant Floor): Field devices, controllers, and supervisory systems. Strictly isolated; no direct internet access.
• Level 3 (Site Operations / DMZ): Historian servers, OT data diodes, and jump servers. The only bridging point between IT and OT.
• Level 4–5 (Enterprise IT and Cloud): ERP systems, corporate email, cloud dashboards.

In practice, Indian manufacturers often have no Level 3 DMZ at all — OT and IT exist on the same flat network. Introducing a demilitarised zone requires a next-generation firewall between Levels 2 and 3, enforcing application-layer inspection of OT protocols and strictly controlling what communications are permitted.

FortiGate for OT/IT Boundary Enforcement

FortiGate NGFWs are increasingly deployed at the IT-OT boundary for a specific reason: Fortinet’s FortiOS includes OT-aware deep packet inspection (DPI) for Modbus, DNP3, IEC 60870-5-104, and other industrial protocols. This allows a security policy to state not just “allow Modbus traffic” but “allow Modbus function code 3 (read holding registers) but block function code 6 (write single register)” — a critical distinction that generic firewalls cannot make.

PJ Networks deploys FortiGate in IT-OT boundary roles with:

• IPS signatures tuned for OT protocols and known ICS vulnerabilities
• Micro-segmentation between engineering workstations, historians, and jump servers
• Strict egress filtering to prevent OT network data from leaving without explicit policy approval
• SSL inspection on OEM vendor remote access sessions

OT Visibility: You Cannot Protect What You Cannot See

One of the most common gaps we find during OT assessments is a complete lack of asset inventory below Level 3. IT teams know their endpoints; OT teams know their machines — but nobody has a unified, continuously updated map of every PLC, HMI, engineering workstation, and network switch on the plant floor.

Passive OT asset discovery — using protocol-aware network taps that monitor traffic without active scanning (which can crash legacy PLCs) — is the accepted approach. It builds the inventory and identifies anomalies: unexpected Modbus writes, new devices appearing on the network, unusual traffic from historian servers outside business hours.

PrahiX Ora: Unified SecOps Across IT and OT Environments

One of the fundamental challenges of IT-OT convergence is that your IT security tools and your OT monitoring tools were built for different worlds and report to different teams. Correlating a suspicious login on the corporate domain controller with an anomalous SCADA poll two hours later requires a platform that can ingest and correlate both data streams.

PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd that we deploy and operate for clients who need exactly this cross-domain visibility. Here is how its four pillars apply directly to OT/ICS environments:

SIEM: Correlating IT and OT Events on a Single Timeline

The platform ingests logs from corporate Active Directory, email gateways, firewalls, and endpoint agents alongside syslog from historians, engineering workstations, and OT-aware network sensors. Correlation rules are mapped to MITRE ATT&CK for ICS (a separate MITRE matrix specifically for OT threat techniques), enabling graph-based attack storyline reconstruction that spans both environments. With CERT-In’s direction on 180-day in-country log retention, centralised log storage in the platform ensures both compliance and the investigative depth needed when something goes wrong weeks after an intrusion began.

NMS: Network Observability Across Plant and Corporate

Unified observability across firewalls, switches, wireless APs, WAN links, and SD-WAN overlays means the NOC team sees a single topology — from the corporate headquarters down to the plant floor switches. LLDP/CDP topology discovery, network path tracing, and ML-based anomaly detection are especially valuable in multi-vendor manufacturing estates where NOC visibility is fragmented across separate tools. Auto-healing policies can isolate a misbehaving plant-floor segment before the security team has even been paged.

Video Surveillance (VMS): Physical and Cyber Under One Operations View

For manufacturing sites with ONVIF, Hikvision, or Dahua IP cameras, the platform’s video surveillance module brings physical security into the same operations view as network security. A forced entry at a server room correlates with an anomalous VLAN change three minutes later — a pattern that is invisible when physical and network security are monitored by separate teams. Multi-site manufacturing and retail estates benefit most, where a centralised operations view across all locations replaces a patchwork of individual DVR systems.

SOAR: Making CERT-In’s 6-Hour Window Achievable

CERT-In’s 2022 directive requires organisations to report cybersecurity incidents within six hours of detection. For most OT environments without automation, that timeline is simply not realistic — incident triage, escalation, and evidence collection alone can take longer than six hours. The platform’s SOAR capabilities include pre-built playbooks and automated response actions: pushing IoC-based blocklists directly to FortiGate, isolating a compromised jump server segment, and generating the structured incident report required by CERT-In — all triggered automatically when the SIEM fires a high-confidence alert. Automation is what makes a six-hour reporting window achievable rather than aspirational.

If your organisation is evaluating unified SecOps for a converged IT/OT environment, we are happy to walk through a reference deployment scenario — reach out to the PJ Networks team.

Zero Trust for OT: Practical Steps, Not Theory

Zero Trust is often discussed in the context of corporate remote access. In OT environments, the same principles apply — but implementation must be adapted to the constraints of legacy systems that cannot run agents or support modern authentication protocols.

Practical Zero Trust Steps for Indian OT Environments

• Inventory every remote access pathway: VPN tunnels for OEM vendors, TeamViewer sessions, legacy dial-up modems (yes, they still exist in some Indian plants). If you don’t know it’s there, you can’t control it.
• Replace always-on vendor VPNs with ZTNA: Fortinet’s ZTNA solution allows OEM vendors to access only the specific system they need, for a defined time window, with session recording. Contrast this with a traditional site-to-site VPN that gives the vendor access to your entire OT network segment.
• Enforce MFA on every jump server: The Level 3 jump server is the single chokepoint between IT and OT. Every human session into this zone — whether an internal engineer or an OEM vendor — must require a second factor. No exceptions.
• Segment engineering workstations from controllers: Engineering workstations are the most valuable targets for OT attackers — they hold PLC logic, network maps, and credentials. Micro-segment them from controllers and from the corporate network simultaneously.
• Implement unidirectional data diodes for historian access: If business intelligence only needs to read process data from the historian, use a hardware data diode (or software equivalent) to enforce that data flows only outward from OT to IT — never the reverse.

Incident Response Planning for OT: Different from IT IR

An IT incident response playbook does not translate directly to OT. Before an incident, answer these questions with both your IT and OT teams:

• What is the acceptable downtime for each process? Some processes can be halted immediately; others (continuous chemical processes, furnaces, pharmaceutical batch reactors) cannot be stopped safely in minutes.
• Who has authority to disconnect an OT segment? Disconnecting the historian from the corporate network during an incident may be the right call — but it will also disable the dashboards that operations management uses. Whose call is that?
• Do you have offline backups of PLC logic and SCADA configuration? Ransomware encrypting an engineering workstation can destroy the only copy of decades-old PLC programs if backups were not taken.
• Can you operate manually? Map out which processes can run in manual mode and train operators on those procedures now, not during an incident.

Compliance Touchpoints: CERT-In and DPDP for OT Operators

Indian manufacturers operating as Critical Information Infrastructure (CII) are subject to CERT-In’s reporting requirements. Even non-CII manufacturers handling personal data of employees or customers must consider the Digital Personal Data Protection (DPDP) Act, 2023. OT systems that log biometric access data, track employee locations on the shop floor, or handle customer order data interact with DPDP obligations in ways that many OT teams have not yet assessed.

PJ Networks helps clients map CERT-In reporting workflows and supports compliance with DPDP Act obligations for OT-adjacent data — without claiming that any tool or service makes an organisation automatically compliant. Compliance is a programme, not a product purchase.

Taking the First Step

The most common question we hear from Indian manufacturing CISOs is: “Where do I start?” Our answer is consistently: start with visibility. Before you can segment, detect, or respond, you need to know what you have.

A structured OT security assessment — combining passive network discovery, architecture review, and threat modelling against your specific industry vertical — gives you the foundation for a prioritised roadmap. From there, the path leads through segmentation, monitoring, and ultimately a converged IT/OT SecOps capability.

PJ Networks provides managed security services for Indian manufacturing enterprises, including FortiGate NGFW deployment and management, 24/7 NOC/SOC monitoring, and ZTNA implementation. If you are ready to understand your OT attack surface, contact us for an OT security assessment.