- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing sector is in the midst of a historic transformation. The Production-Linked Incentive (PLI) scheme, surging FDI into electronics and auto-components, and the government’s Make in India push have brought Industry 4.0 technologies onto the shop floor at an unprecedented pace. Industrial robots, SCADA systems, programmable logic controllers (PLCs), and IoT sensors are now deeply woven into production lines at factories in Pune, Chennai, Ahmedabad, and across the country’s industrial corridors.
What most CISOs have not fully reckoned with yet is that this connectivity boom has dramatically expanded the attack surface. Operational Technology (OT) and Industrial Control Systems (ICS) that once ran in isolated, air-gapped silos are now reachable — often inadvertently — from corporate IT networks, vendor VPNs, and in some cases, the public internet. For attackers, that is an open invitation.
At PJ Networks, we have seen a sharp rise in inquiries from manufacturing CISOs in the past 12 months. The common thread: a near-miss or a neighbour’s incident has finally forced the question onto the board agenda. This post is a practical guide to what OT/ICS security actually entails, what the Indian threat landscape looks like, and how to build a defensible posture without halting production.
Attackers target production environments for two reasons: disruption and data. Disrupting a factory line — even for a few hours — creates enormous financial pressure. For just-in-time manufacturers supplying OEMs, downtime can trigger penalty clauses, disrupt downstream supply chains, and result in losses that dwarf the ransom demand. Meanwhile, the intellectual property sitting on engineering workstations — CAD drawings, process parameters, proprietary formulations — is exactly what nation-state actors and industrial espionage groups are after.
The 2021 Oldsmar water treatment plant attack in Florida and the repeated targeting of energy sector SCADA systems across Europe are well-documented examples. India is not immune: CERT-In advisories have specifically flagged threat actors probing Indian critical infrastructure and industrial networks.
Historically, OT networks ran proprietary protocols — Modbus, DNP3, PROFINET, EtherNet/IP — on physically separate networks. The only connectivity was occasional USB data transfers or dial-up maintenance access. Today, the demands of real-time production analytics, remote vendor support, and ERP integration have punched holes in that isolation. Each integration path is a lateral movement opportunity for an attacker who has already footholded the IT network — or vice versa.
The Purdue Enterprise Reference Architecture provides a sensible layered model: Levels 0-1 for field devices, Level 2 for supervisory systems, Level 3 for site operations, a DMZ, and Level 4-5 for corporate IT. Its segmentation principles are sound — but static, perimeter-centric assumptions break down with cloud connectivity and vendor remote access. OT-aware deep packet inspection, micro-segmentation, and continuous monitoring are needed to complement it.
You cannot protect what you cannot see. Begin with a passive asset discovery exercise using purpose-built OT discovery tools that listen to network traffic without actively scanning (active scans can crash PLCs). Map every device, its firmware version, its communication peers, and its network exposure.
Deploy a next-generation firewall between each Purdue level, configured with strict allowlists. FortiGate’s Industrial Security service provides OT/ICS protocol inspection for over 70 industrial protocols — permitting Modbus read commands while blocking write commands that could alter PLC configurations. Place a dedicated firewall in the DMZ between Level 3 and Level 4 and require all IT-OT data flows to pass through it. Critically, collapse all vendor remote-access connections through a single, monitored jump server in the DMZ.
Default and shared credentials are endemic in OT environments. Rotate all OT credentials immediately, implement a privileged access workstation (PAW) for OT administration, require MFA for access to Level 3 and above, and log every privileged session.
Patching in OT is fundamentally different from IT patching. A patch that requires a 10-minute reboot is a 10-minute production stoppage. OT vulnerability management requires risk-ranked inventories, compensating controls for unpatched systems, and coordination with production planning for maintenance windows.
An IT incident response playbook does not translate to OT. Develop OT-specific runbooks in collaboration with plant operations leadership that address when safety overrides security, and conduct tabletop exercises with both IT and OT operations teams.
One of the persistent frustrations we hear from manufacturing CISOs is the lack of a unified operations view across IT and OT. PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner — we deploy, integrate, and operate Ora for clients across manufacturing, logistics, and financial services. Here is how the platform’s four pillars address the OT security challenge.
SIEM: Correlated detection across IT and OT event streams. Ora’s SIEM ingests logs from SCADA historians, industrial firewalls, Windows-based HMIs, and corporate IT infrastructure into a single correlation engine. Detection rules are mapped to MITRE ATT&CK for ICS — a dedicated framework covering OT-specific tactics. When an attacker moves from a phishing-compromised workstation toward a Level 3 historian, the cross-domain attack storyline is reconstructed in a graph view. For CERT-In’s 180-day in-country log retention requirement, Ora provides tiered storage (hot/warm/archive) with India-resident data handling, helping evidence compliance without ballooning storage costs.
NMS: Network observability across your entire estate. Ora’s NMS provides unified observability across firewalls, switches, access points, and WAN/SD-WAN links, using LLDP/CDP discovery to automatically map topology including OT network segments. ML-based anomaly detection flags unusual traffic patterns — a PLC suddenly communicating with an external IP, or a historian initiating outbound connections — with auto-healing policies to trigger a FortiGate policy push or a port shutdown in response.
Video Surveillance (VMS): Physical and network security under one operations view. Ora’s video surveillance module (VMS) provides ONVIF/Hikvision/Dahua-compatible camera management with video analytics, unified into the same operations view as network and security events. For multi-site manufacturing or retail estates, this means a single operator can correlate a physical access event at the server room door with a simultaneous network login attempt.
SOAR: Automation built for the CERT-In 6-hour window. Ora’s SOAR module provides pre-built playbooks with direct connectors to FortiGate. When a ransomware indicator is confirmed, the playbook can automatically push a blocklist update to the FortiGate firewall, quarantine the affected segment, and generate the structured incident report that CERT-In requires. That automation is what makes a 6-hour window realistic at scale; without it, human analysts are still manually correlating logs when the reporting deadline passes.
If your organisation operates across multiple manufacturing sites or manages a mix of IT and OT assets, our team is happy to walk you through an Ora deployment architecture. Reach out to us to schedule a demonstration.
India’s manufacturing sector has an unprecedented opportunity — and an unprecedented responsibility. The same connectivity that enables real-time analytics, predictive maintenance, and remote operations also creates attack paths that adversaries are actively mapping.
At PJ Networks, our managed security practice includes OT/ICS security assessments, FortiGate deployment and operations across IT and OT boundaries, and 24/7 NOC/SOC monitoring that covers both enterprise IT and industrial network segments. Contact us to start the conversation.