- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing sector is undergoing a profound digital transformation. From automotive plants in Pune to pharmaceutical facilities in Hyderabad and steel mills in Odisha, industrial operations increasingly rely on networked Operational Technology (OT) — programmable logic controllers (PLCs), SCADA systems, Distributed Control Systems (DCS), and Industrial Internet of Things (IIoT) devices. This convergence of IT and OT has delivered remarkable efficiency gains. It has also opened a vast and largely undefended attack surface.
In the past three years, cyberattacks targeting industrial control systems (ICS) globally have increased at an alarming rate. Ransomware gangs that once focused exclusively on IT networks have pivoted to OT environments, knowing that a production line shutdown creates immediate, quantifiable pain — and a far higher likelihood that victims pay. For Indian enterprises, the threat is no longer hypothetical. It is operational.
Traditional IT security practices do not map cleanly onto OT environments. Several structural factors create persistent exposure:
Understanding the attack patterns targeting ICS/OT environments helps prioritise defences. Threat actors use several well-documented approaches:
Modern ransomware operators conduct reconnaissance before deploying payloads. They deliberately target historian servers, engineering workstations, and HMI systems — knowing that encrypting these assets stops production. In several documented incidents across Asia, attackers encrypted both IT and OT management layers simultaneously, demanding ransoms in the millions of dollars with a 48-hour deadline tied to production downtime costs.
Sophisticated threat actors — including nation-state groups targeting critical infrastructure — use legitimate OT tools (engineering software, remote desktop utilities, vendor maintenance tools) to move laterally once inside. This makes detection extremely difficult without behavioural baselining of normal OT traffic patterns.
Attackers have learned to compromise the maintenance laptops and remote access credentials of OEM vendors — automation suppliers, SCADA integrators, PLC manufacturers — and use those trusted connections to enter OT environments. Once inside via a trusted vendor connection, they operate under the radar of perimeter defences.
A growing concern is attacks designed not to steal data but to cause physical damage — manipulating setpoints on industrial processes to damage equipment, create safety incidents, or produce defective output that escapes detection. The Triton/TRISIS malware, which targeted Safety Instrumented Systems (SIS) in a Middle Eastern petrochemical plant, remains the most chilling example of this class.
India’s manufacturing ambitions under the Production Linked Incentive (PLI) scheme and the “Make in India” initiative are accelerating OT deployment across sectors — pharmaceuticals, electronics, defence manufacturing, food processing, textiles, and automotive. This creates a large, fast-growing attack surface at exactly the moment when geopolitical tensions are making India’s critical infrastructure a target of interest for state-sponsored threat actors.
CERT-In’s revised directives under the Information Technology Act mandate 6-hour breach reporting for critical infrastructure operators. Manufacturers covered under this framework face not only the operational impact of an OT attack but potential regulatory consequences if they fail to detect and report incidents promptly. Without OT-specific monitoring in place, meeting the 6-hour reporting window is effectively impossible.
There is no single product that secures an OT environment. Effective defence requires a layered architecture built around the Purdue Model (or its modern equivalent, the ISA/IEC 62443 standard), adapted for real-world Indian manufacturing constraints.
The foundation of OT security is strict network segmentation. The corporate IT network (ERP, email, internet access) must be separated from the OT network (SCADA, DCS, PLCs) by a properly configured industrial demilitarised zone (iDMZ). FortiGate next-generation firewalls are particularly well-suited here: they provide deep-packet inspection for OT protocols including Modbus/TCP, DNP3, EtherNet/IP, and IEC 61850, enabling granular policy enforcement at the IT/OT boundary without impacting protocol performance.
No direct routed path should exist between Level 4 and Levels 1/0. Data flows must be mediated through the iDMZ, with unidirectional data diodes for the most sensitive production segments.
You cannot protect what you cannot see. Many manufacturers are surprised to discover dozens of undocumented PLCs and legacy HMIs when they perform their first OT asset audit. Passive asset discovery tools — which listen to network traffic without sending probes that could destabilise sensitive equipment — build a complete inventory of OT devices, their firmware versions, and communication patterns.
This inventory becomes the foundation for vulnerability management: understanding which devices carry known CVEs, which run end-of-life firmware, and which are communicating in unexpected ways.
Replace broad-access VPNs with Zero Trust Network Access (ZTNA) principles applied to OT. Every remote connection to OT systems should be:
This is perhaps the largest gap in most Indian manufacturers’ security posture: even when good perimeter controls exist, there is no one watching. Attacks on OT environments often develop slowly — reconnaissance, privilege escalation, lateral movement — over days or weeks before the payload deploys. A 24/7 SOC with OT protocol awareness and behavioural baselining can detect anomalies (an engineering workstation sending Modbus write commands it has never sent before; a PLC communicating to an internet IP for the first time) and trigger incident response before the attack reaches the production layer.
OT incident response is fundamentally different from IT. You cannot simply isolate and reimage a PLC — you need to coordinate with production engineering, safety teams, OEM vendors, and sometimes regulators. Every manufacturer should have a documented OT-specific IR plan that includes:
Patching OT systems requires coordination with production schedules. Adopt a risk-based approach:
Fortinet offers a comprehensive and validated OT security portfolio that addresses the unique constraints of industrial environments. Key components relevant to Indian manufacturers include:
Indian manufacturers in specific sectors face overlapping regulatory obligations that directly implicate OT security:
For most Indian manufacturers, the starting point is not a technology purchase — it is an honest assessment of the current state. A structured OT security assessment covers:
The output of this assessment becomes a prioritised remediation roadmap tied to your production schedule and risk appetite.
PJ Networks is an Indian MSSP with deep expertise in Fortinet’s security ecosystem and extensive experience designing and operating security architectures for enterprise and industrial clients across India. Our OT/ICS security practice offers:
If your manufacturing facility has connected IT and OT environments — even partially — you are already exposed. The question is not whether an OT-targeted attack is possible. It is whether you will detect it in time to prevent a production shutdown, a safety incident, or a regulatory breach notification.
Ready to assess your OT/ICS security posture? PJ Networks offers a no-obligation OT Security Assessment for Indian manufacturers. Contact us to schedule a conversation with our industrial security team.