Security
Protection of OT systems under ENS, IEC 62443, NIST and IACS UR E26/E27.
A control system cannot be switched off to be patched, it cannot be rebooted just because maintenance is due, and when it stops, a plant, a building or a critical infrastructure comes to a halt.
That is the difference between industrial cybersecurity and office cybersecurity, and it is why applying IT recipes is not enough. At DES, we know what can be touched and what cannot, because we come from designing and commissioning these systems.
Auditing. We assess the real state of the installation: asset inventory, network architecture, access, exposure and vulnerabilities. On the live system, without interrupting operations.
Consulting. We turn the findings into a plan prioritised by risk and operational feasibility.
Implementation. We carry out the measures. Configuration of network and security equipment, segmentation of the industrial network and hardening of control systems.
That last point is what makes the difference. Segmenting an OT network in production requires knowing what communicates with what and what happens if it is cut off, and that is only known by having built that kind of installation.
Industrial control systems in production environments, critical infrastructure and buildings with centralised management systems, and shipboard systems, where classification society frameworks add requirements of their own.
We carry out cybersecurity work at facilities in accordance with the US Department of Defense UFGS specifications: system security auditing, risk and vulnerability analysis, access control, logging and monitoring, and assessment and authorisation of security controls.
Working within that framework calls for a different delivery discipline —documentation through submittals, segregated network architectures and formal validation of every control— which we then also apply to civil projects.
We work within the frameworks each environment requires: the Spanish National Security Framework (ENS) for the public sector, NIS2 for essential service operators, the NIST cybersecurity framework, IEC 62443 for industrial automation and control systems, and the IACS UR E26 and E27 unified requirements in the maritime sector.
When the project is ours —a control panel, a SCADA, an integration— security is not a later phase. It is built into the architecture from the start, because adding it afterwards always costs more and protects less.
