Interactive · Range Lab
The computersthat run your plantare not an IT problem.
We secure the control systems behind production lines, utilities and large facilities in the UAE. Not the office network. The plant.
Scroll to descend the plant ↓Topology, protocols, ports and poll rates are real. The plant shown is illustrative, not a client’s network.
One site. About 1,400 things that can be talked to.
Field instruments, controllers, panels, servers. Most of them were commissioned by different vendors, in different years, and no single document lists them all.
This is a representative mid-size plant: six lines, 200–600 staff.
Your IT team secures the top two floors of this building.
Corporate identity, ERP, email, the SOC. They do it well, and their tools were built for exactly this. Everything above the line is theirs.
Nothing talks through the DMZ. Everything talks to it.
The plant historian pushes out. The enterprise reads the copy. A remote session terminates at the gateway and a second, separate session opens on the far side.
Legitimate crossings: historian replication on 5450, patch distribution via the WSUS replica, brokered remote access on 443. Modbus, EtherNet/IP and S7comm never cross.
“All IACS network traffic from either side of the IDMZ terminates in the IDMZ; no IACS traffic directly traverses the IDMZ.” (Rockwell/Cisco CPwE, enet-td009.) Level 3.5 is a CPwE convention; ISA-95 and Purdue define 0 to 5.Below the line, the tools your IT team owns stop working.
No agent goes on a controller. No credentialed scan touches a live process network. An active vulnerability scan has stopped production lines. That is not a hypothetical.
Historian collection runs on 1-second and 5-second scan classes. Operator stations poll their PLCs every 500 ms.
Down here nothing is encrypted, and nothing checks who is asking.
Modbus has no authentication. Any host that can reach TCP 502 can write to any register. EtherNet/IP implicit I/O runs on a 10 ms interval and PROFINET RT is not even routable; it has no port number at all.
The only control that exists at this layer is which machines can reach which. That is the whole argument for the boundary.
No real plant matches its own drawing.
Three paths here bypass the boundary entirely. Every one of them was installed by someone competent, for a good reason, on a deadline.
None of them appear on the network diagram in your control room.
What happens next
We start by listening. Three to five days on site, no packets injected.
A span port or a passive tap. We read the traffic your control network is already producing and hand you the first accurate asset inventory the site has had in a decade: every device, firmware revision and protocol, with the conduits between them.
Then we tell you which of them cross a line they should not.