Understanding OT Network Risk
Operational technology networks were not designed with cybersecurity as a foundational concern. OT security programs typically include SCADA security testing for control system components alongside an OT network assessment. Organizations with connected devices operating at the edge of the industrial network may also require an IoT security assessment to evaluate firmware, physical interfaces, and cloud backend communications. Their primary engineering requirements are determinism, availability, and real-time performance. A PLC managing a chemical process or a turbine governor controlling power generation cannot tolerate the latency, reboots, or behavioral changes that standard IT security tooling introduces. This fundamental incompatibility means that the security strategies, tools, and workflows developed for enterprise IT environments do not transfer cleanly to OT networks. Applying them without modification can cause exactly the kind of operational disruption that organizations are most afraid of.
The Purdue Enterprise Reference Architecture, which defined logical separation between field devices, control systems, supervisory networks, and enterprise IT, provided a useful conceptual model for ICS network design for decades. In practice, IT/OT convergence has collapsed many of those boundaries. Business pressures for real-time operational data, remote monitoring, predictive maintenance, and supply chain integration have created a dense web of connections between OT systems and enterprise networks, cloud platforms, and third-party vendor systems. Each of those connections is a potential attack path, and many were established informally, without security architecture review, and without documentation that would allow anyone to fully understand the current network topology.
Legacy PLCs and RTUs in OT environments frequently run firmware that has not been updated in years, either because vendor patches do not exist for obsolete equipment, because update procedures carry unacceptable production risk, or because the systems have simply been forgotten. These devices are often directly accessible on the network with no authentication required to issue control commands, because they were installed before network connectivity was anticipated. Remote access for vendor support compounds this exposure: persistent vendor VPN tunnels, shared credentials, and accounts that were provisioned for a maintenance visit and never deprovisioned represent standing access that is effectively invisible to the organization's security team. Regulatory frameworks including NERC CIP for the electric sector, TSA cybersecurity directives for pipelines and rail, CISA advisories for critical infrastructure broadly, and IEC 62443's zones-and-conduits model all address these risks, but compliance with the framework and genuine security are not the same thing.
NYCF's OT Network Assessment Process
NYCF's OT network assessment follows a five-phase methodology developed specifically for environments where disruption is not an acceptable outcome. Every tool selection, every network interaction, and every data collection method is evaluated against the question of whether it could affect production operations before it is used. This discipline is not optional in OT environments: a single broadcast storm on a control network, or an unexpected packet to a legacy PLC, can cause real-world consequences far beyond anything that occurs in a compromised IT environment.
Phase one is asset inventory and network mapping using exclusively passive techniques. NYCF places network taps or configures span ports on key network segments and captures traffic over a monitoring window, typically 24 to 72 hours, sufficient to observe both real-time control communications and periodic scheduled processes. From this capture, we build a complete picture of every device present on the network, every communication relationship between devices, and every protocol in use, without transmitting a single packet of our own into the control network. This passive inventory frequently reveals devices that were unknown to the operations team, communication paths that were undocumented, and protocol usage that indicates security concerns.
Phase two reviews network architecture and segmentation against the Purdue model and IEC 62443 zone-and-conduit requirements. We examine where the actual network boundaries are, how traffic flows across them, what controls enforce those boundaries, and where the boundary controls can be bypassed. Phase three is communication flow analysis: examining east-west traffic within OT network segments for unexpected lateral communication between devices, evaluating DMZ effectiveness at the IT/OT boundary, and reviewing historian server configurations that bridge both environments. Phase four applies OT-safe vulnerability scanning tools that are validated for use in ICS environments, producing a list of known vulnerabilities in identified assets cross-referenced against current CVE and ICS-CERT advisory databases. Phase five consolidates all findings into a risk-ranked report with a remediation roadmap that accounts for OT-specific constraints, including assets that cannot be patched and must instead be protected through compensating controls such as network segmentation, application whitelisting, or enhanced monitoring.
Passive Asset Inventory and Network Mapping
Network taps and span ports capture all traffic without injecting packets into the control network. Every device, communication path, and protocol in use is identified and documented.
Architecture and Segmentation Review
Network design is evaluated against the Purdue model and IEC 62443 zone-and-conduit requirements, identifying boundary weaknesses, flat network conditions, and uncontrolled IT/OT connections.
Communication Flow Analysis
East-west traffic patterns, DMZ effectiveness, and historian server configurations are analyzed to identify unexpected lateral movement paths and boundary bypass conditions.
OT-Safe Vulnerability Identification
Validated OT-safe scanning tools identify known vulnerabilities in identified assets, cross-referenced against CVE and ICS-CERT advisories, without risk to production systems.
Risk-Ranked Report and Remediation Roadmap
All findings are consolidated and prioritized by operational impact and exploitability. Remediation recommendations account for OT constraints including unpatchable assets, availability requirements, and compensating controls.
OT Assessment Deliverables for Legal and Operational Teams
An OT network assessment produces value for multiple audiences with different needs. Operations teams and engineering staff need technical specificity: which devices are vulnerable, what the attack paths look like, and what exactly needs to change. Legal teams and risk officers need clear, documented evidence of security posture for purposes of regulatory compliance, litigation, insurance underwriting, or board-level risk governance. NYCF structures every OT assessment report to serve both audiences without sacrificing the depth either requires.
The deliverable package includes a complete network topology diagram produced from passive traffic analysis, showing every identified device, communication path, and network boundary. This diagram frequently becomes the first accurate representation of the OT network that the organization has ever had: many OT environments have grown organically over years without systematic documentation, and the topology that exists in practice differs significantly from what appears in any existing diagram. Alongside the topology, NYCF provides a full asset inventory with risk scores assigned to each device based on its vulnerability profile, network exposure, and criticality to operations.
The findings report presents all identified vulnerabilities in a format that serves legal and regulatory purposes as well as operational ones. The executive summary is written in plain language for attorneys, risk officers, and executives who need to understand the nature of the risk without technical background. The technical annex provides the depth that engineering and operations teams need to act on the findings. For organizations subject to IEC 62443, NIST SP 800-82, NERC CIP, or TSA cybersecurity directives, NYCF maps every finding to the applicable standard requirement, creating a compliance gap document that supports both internal remediation planning and regulatory audit response. When findings from an OT assessment become relevant to litigation, whether because a security failure contributed to a loss or because a party's security posture is at issue, NYCF's certified analysts are available to provide expert witness testimony grounded in the documented assessment methodology and findings.
Network Topology Diagrams
Accurate, passively derived network topology maps showing every device, communication relationship, and boundary control, often the first accurate OT network diagram the organization has possessed.
Plain-Language Executive Report
Findings presented for attorneys, executives, and risk officers without requiring technical background. Suitable for board reporting, insurance underwriting, and regulatory submissions.
Compliance Gap Mapping
Every finding mapped to IEC 62443, NIST SP 800-82, NERC CIP, and TSA cybersecurity directive requirements, supporting audit preparation and regulatory notification obligations.
Expert Witness Availability
NYCF analysts provide expert witness testimony in disputes arising from OT security failures, grounded in the documented assessment methodology, findings, and chain-of-custody evidence.