Multi-Plant Manufacturer Connects Plant Networks and Business Systems With Ollandi
A consumer goods manufacturer with several production plants uses Ollandi to watch the boundary between plant networks and business systems, where both production outages and intrusions tend to begin.
The condition
The manufacturer runs several plants that share a central ERP system, a warehouse management system and a corporate network. Each plant has its own production network, maintained partly by equipment vendors.
Two kinds of incident kept crossing the line between plant and office. A change in the corporate network would break a plant's connection to ERP, and production would stop waiting for orders. And the paths that let business systems and vendors reach the plants were the same paths an intruder would use. The plant engineers and the IT security team rarely looked at that boundary together.
Ollandi's role
The manufacturer deployed Ollandi to model the plant networks, the corporate network, identity and the business systems as one environment, with particular attention to every path that crosses between them. Ollandi reads state from existing tools and does not send commands to production equipment.
Production dependencies in view
Ollandi maps which plant processes depend on which business systems and network paths. When a link, firewall rule or ERP interface changes, it shows which production lines are exposed before the change reaches them.
The plant boundary watched for intrusion
Movement from the corporate network toward a plant network, new remote sessions into plant systems and changes to accounts with plant access are correlated into threat sequences. The security team receives one case per sequence, with the plant consequence stated.
Approved, reversible response
The deployment runs under the Assisted Response control. Ollandi recommends actions on the IT side of the boundary, such as disabling an account or closing a remote session, and an authorized operator approves each one. Decisions about production equipment remain with plant engineering.
The operating outcome
Plant engineers and IT security now review the same boundary from the same evidence. Changes that would have stopped a production line are caught while they can still be corrected, and suspicious access toward the plants is contained on the IT side without anyone touching production equipment.
Operating control: Assisted Response.
