Challenges Before Adoption
■ Background
C Chemical was facing security blind spots during its smart factory transition.
• Factory automation equipment (PLC, DCS) exposed to the internet
• The IT security team had no visibility into security in the OT (operational technology) domain
• Many legacy control systems still running on Windows XP
• No management of remote access by external maintenance vendors
• Growing concern among management after a 2022 ransomware incident at a company in the same industry
In particular, because security incidents in chemical processes can lead to safety accidents, a proactive response was essential.
C Chemical was facing security blind spots during its smart factory transition.
• Factory automation equipment (PLC, DCS) exposed to the internet
• The IT security team had no visibility into security in the OT (operational technology) domain
• Many legacy control systems still running on Windows XP
• No management of remote access by external maintenance vendors
• Growing concern among management after a 2022 ransomware incident at a company in the same industry
In particular, because security incidents in chemical processes can lead to safety accidents, a proactive response was essential.
YourIT's Solution
■ YourIT's Solution
1. OT/IT security assessment (4 weeks)
- Security vulnerability assessment based on ICS-CERT standards
- Network asset identification and communication pattern analysis
- Network segmentation design based on the Purdue model
2. Industrial control system security hardening (8 weeks)
- OT-dedicated firewalls
- Adoption of industrial IDS/IPS solutions
- Logical IT/OT separation with a control network DMZ
3. Remote access security framework (3 weeks)
- Adoption of a privileged access management (PAM) solution
- Dedicated security gateway for external partners
- Session recording and audit trail system
4. Security monitoring and response framework (3 weeks)
- OT security operations center (OT-SOC)
- Security incident response scenarios and manuals
- Regular drill program
1. OT/IT security assessment (4 weeks)
- Security vulnerability assessment based on ICS-CERT standards
- Network asset identification and communication pattern analysis
- Network segmentation design based on the Purdue model
2. Industrial control system security hardening (8 weeks)
- OT-dedicated firewalls
- Adoption of industrial IDS/IPS solutions
- Logical IT/OT separation with a control network DMZ
3. Remote access security framework (3 weeks)
- Adoption of a privileged access management (PAM) solution
- Dedicated security gateway for external partners
- Session recording and audit trail system
4. Security monitoring and response framework (3 weeks)
- OT security operations center (OT-SOC)
- Security incident response scenarios and manuals
- Regular drill program
Results
■ Results
Quantitative results:
• Higher security threat detection rate
• Shorter threat response time
• 90% of security vulnerabilities resolved
• Stronger remote access authentication: 2FA applied
Qualitative results:
• Obtained ISMS-P certification
• Improved safety management system
• Lower insurance premiums
• Security capabilities built in-house
"What impressed us was that they didn't just install security solutions; they worked with our process engineers to create security policies that reflect our actual operating environment."
- Seongmin Park, Team Lead, Safety & Security Team, C Chemical
Quantitative results:
• Higher security threat detection rate
• Shorter threat response time
• 90% of security vulnerabilities resolved
• Stronger remote access authentication: 2FA applied
Qualitative results:
• Obtained ISMS-P certification
• Improved safety management system
• Lower insurance premiums
• Security capabilities built in-house
"What impressed us was that they didn't just install security solutions; they worked with our process engineers to create security policies that reflect our actual operating environment."
- Seongmin Park, Team Lead, Safety & Security Team, C Chemical
