Home / Services / OT assessment
Step 1 · Plant-safe assessment
A plant-safe security assessment of live SCADA, DCS, EMS, and process control.
This assessment is done on live operational systems, so the team takes care not to impact the plant. The work goes from the perimeter down to the PLCs, RTUs, and field instrumentation. Level 3.5 and down. Only OT, not IT. Water districts and municipal buyers know it as the infrastructure security assessment.
Who it is for
Plant managers, utility boards, and OT security leads who need a true picture of a running facility and will not accept downtime as the price. Interview answers on security controls are often not in alignment with real-world conditions in OT. Passive collection is how the team checks those answers against the live plant.
What happens on site
When the Red Tiger team arrives at the facility, the team and your operations group meet to go over the steps for the next several days. Site hazards and any safety briefing come first. Then the team walks the plant with an operations escort who can explain the process and where the OT is installed.
- Kickoff, plant tour, computer room, control rooms, and network closets. Physical inventory. Who has the keys to the DCS cabinets.
- Document and configuration collection: logical diagrams, IP lists, device configs, data flows, policies, and prior assessments.
- Passive traffic capture from a SPAN port or tap, a slice of traffic per segment. The team uses the IoTSecure.io mini to do it.
- Host collection with REDCAT on SCADA workstations, servers, touchscreens, and panel PCs. The team runs it on one host first so the operators can see it does not change the workstation or server. Then the rest. Nothing is installed and nothing is written back.
- Active scanning, if it happens at all, is on computing systems, not field devices, and only after operations has been told so the work can stop immediately if there is any impact. Systems that are shut down are preferred.
Six layers
Physical, perimeter, ICS DMZ, control-room hosts, protocols, and field. Top to bottom.
What you get
- A written assessment report.
- Prioritized remediation of the immediate need.
- Updated logical and data-flow drawings where yours are out of date.
- A board presentation of findings and remediation options, if you want one.
- A retest, if you want one.
Analysis happens off the plant, and the data leaves in an encrypted vault. At closeout the team goes over any high or critical risks it saw while on site. Most of the analysis is manual. It is not like an IT assessment where the team can run a tool and pop out a report. Two to three weeks is a normal report cycle.
What the team will not do
- Take the plant down to be thorough.
- Hand you 80 findings and wish you luck.
Thousands of OT systems · 500+ assessments globally · 20 years · No plant interruptions