Energy & Utilities

Industrial networks, control-system (OT) segmentation and surveillance for hydropower dams, substations, solar farms and water utilities.

Book a site survey

What makes this sector hard

An attack on a dam or substation control system doesn't just lose data. It can black out a region.
Dams and substations sit in remote valleys. Connectivity is OPGW fiber along the transmission line, microwave or satellite.
SCADA installed 10–15 years ago was designed when nobody expected it to be connected to the office network.
Foreign equipment vendors need remote access for maintenance, and sometimes the VPN opened for them is never closed again.
Kilometres of fence in heavy-lightning, high-humidity terrain. Ordinary cameras rarely last more than one wet season.

Reference IT design

In power plants and water systems, rule one is "don't make anything stop". So we start by looking, not by changing things.

1. Find out what's there

Inventory every OT device and what it talks to, using passive collection (listening on a span port) rather than active scanning. Aggressive scans can hang older PLCs. What we commonly find: an engineering PC with two network cards bridging OT and the office, and a 4G modem a former contractor left behind.

2. Segment

Zones and conduits following IEC 62443 principles: a control zone (SCADA/PLC), an intermediate DMZ (historian, data-exchange servers) and the IT zone.
Firewalls between every zone, allowing only the protocols and directions needed. Data flows out of OT into the DMZ, never from the internet into the control zone.
Industrial switches built for substation environments.

3. Control remote access

Secure remote access for vendors and contractors: MFA, approval before every session, sessions that expire on their own, and screen recording. No VPN left permanently open.
EDR or application allow-listing on HMIs and engineering workstations, as approved by the control-system vendor.

4. Monitor and be ready

SOC monitoring collecting firewall and server logs so incidents are caught early.
An incident-response plan written with the plant engineers: if the IT zone gets ransomware, who decides to cut the link, and how long can the plant run in manual?
Careful vulnerability assessment and staff training.
Backups of PLC/SCADA configurations and servers in several places, including offline. When a PLC fails, a configuration nobody can find turns hours of downtime into days.

Connectivity and physical security

Fiber on site and between power station, substations and offices. It's immune to high-voltage fields and lightning.
Point-to-point wireless or microwave where fiber can't go, satellite as backup, and SD-WAN for the IT side back to Vientiane.
Weatherproof IP CCTV on the dam crest, spillway, substations and gates; thermal cameras for long unlit fence lines.
Perimeter security and AI video analytics for intrusion detection; access control for control rooms and switch rooms.
UPS and DC power for communications gear, earthing and lightning protection on every camera pole, and IoT temperature and humidity sensors in equipment rooms.