A security situation occurred in a newly built, automated facility – but was handled before it developed further. Thanks to continuous monitoring, clear role understanding, and OT-security competence, the deviation was detected and neutralised – without consequences for operations, data, or system integrity.
THE CHALLENGE
During maintenance work on network infrastructure, a highly recognised IT consultancy was performing adjustments to a firewall.
The task seemed routine, but in a tightly coupled operational environment, even small changes can have large consequences. Without understanding the dependencies between control systems, the change effectively left critical infrastructure exposed to malicious actors. The consultant had strong IT expertise, but lacked insight into how operational systems were interconnected, and what could be affected by the modification.
THE SOLUTION
Since the facility was under active monitoring by Guard Automation’s Security Operations Center (SOC), the irregularity was detected and managed immediately – before it had any real impact.
Operations continued without interruption, and system integrity was maintained. This is an example of how quickly things can happen – and how important proactive measures, technical insight, and access to people who understand both systems and processes truly are.
Cybersecurity in both IT and OT revolves around confidentiality, integrity, and availability. The difference lies in the order of priority.
IT: C → I → A
Confidentiality and integrity are often prioritised first, while availability can be temporarily sacrificed (for example, during updates or patching) to protect data.
OT: A → I → C
In operational environments, availability comes first to maintain continuous operation and physical control. Integrity of control logic and signals is critical to ensure safe and correct function. Confidentiality still matters, but is rarely the top concern.
Where IT attacks can compromise information, OT incidents can stop operations, damage infrastructure, endanger people and/or the environment.
RESULTS
The deviation was detected and neutralised before it affected the facility. No downtime, no data loss, and no operational consequences. The event demonstrates the importance of continuous monitoring, operational insight, and clear role boundaries between IT and OT environments.
In today’s connected world, IT is the front door to OT. Defending critical infrastructure demands more than firewalls — it demands people fluent in both language.
– Jan-Terje Sørlie, CTO at Guard AutomationCybersecurity in industrial environments is no longer about securing two separate domains — IT and OT. It’s about securing their intersection. That’s where most attacks begin, and where the right competence makes the greatest impact.
