In short. Modern generators, UPS and ATS controllers are networked. That brings visibility and also risk. An OT network should be segmented, redundant where needed, tightly controlled for remote access and designed so that local power control works even when the wider network is down or under attack.
Zone model
| Zone | Contents | Rule |
|---|---|---|
| Control zone | PLCs, relays, generator controllers, ATS | Most protected; minimal access |
| Supervisory zone | SCADA servers, historian, HMI | Restricted flows to control zone |
| DMZ | Data brokers, remote access gateways | Only point of contact with IT and outside |
| Enterprise IT | Business systems | No direct access to control |
Design principles
- Segment with firewalls and VLANs; allow only needed flows.
- Do not rely on the internet for control. Remote monitoring may use it; control stays local.
- Redundancy: ring or dual networks for critical paths. See high availability.
- Remote access: through a controlled gateway with multi-factor authentication, logging and time-limited vendor access.
- Asset inventory: know every device, firmware and owner.
- Patch management: planned, tested and risk-based.
- Logging and monitoring: network logs and alerts to a team that can act.
- Backups: of configurations and programs, stored offline.
Specific risks for power equipment
- Default passwords on controllers, UPS cards and gateways.
- Unmanaged switches and flat networks.
- Vendor modems left active.
- USB devices and laptops moving between networks.
- Wireless links without encryption.
Resilience to loss of network
Devices must keep operating in local automatic mode if the network is lost. Test by unplugging the supervisory network and confirming transfers, sharing and protection still work. See degraded modes.
Recovery
Have a plan to restore controllers and SCADA from backup, with known good configuration and a cleanroom approach if compromise is suspected.
Illustrative example
A site’s generator controllers were visible from the corporate network with default passwords. Remediation separates them into a control VLAN, moves remote access to a gateway with multi-factor authentication, and disables direct internet routes. A test removes the supervisory link; generators continue to share load and transfer correctly.
Why OT networks need their own design
The network that carries breaker status and control commands is part of the power system. Its failure or compromise can affect supply. It must be engineered for availability and security, not just connectivity.
| Zone | Contents | Rule |
|---|---|---|
| Field/control zone | Relays, controllers, PLCs | Isolated from office networks |
| Supervisory zone | SCADA servers, HMI | Controlled access |
| DMZ | Historian mirror, remote access gateway | No direct path from enterprise to control |
| Enterprise | Business IT | Never directly connected to field |
Availability design
- Ring topology or parallel redundancy protocols for control-level networks.
- Industrial-grade managed switches with redundant power.
- Separate networks for critical traffic where needed.
- Battery-backed network equipment.
Security basics
- Firewalls between zones, allow lists of required traffic only.
- Unique accounts, role-based access and logged actions.
- Patch and backup procedures tested and scheduled.
- Removable media controls and device hardening.
- Secure remote access with multi-factor authentication.
Standards for method
IEC 62443 provides a recognised framework for industrial security. Apply it proportionately to site criticality.
See SCADA architecture and degraded modes.
The master engineering question
If an attacker or a fault took control of the network tomorrow, could the plant still operate safely and could we find out what happened?
What to send us
Send network diagrams and device lists. Send your application details.
Questions engineers ask
Is air-gapping realistic?
Rarely complete; plan for controlled connections instead.
Who is responsible, IT or OT?
Both, with clear roles and shared incident plans.
Can vendors connect remotely?
Yes, via controlled, logged, time-limited sessions.
Which standards guide this?
Industrial security frameworks such as IEC 62443 are widely used.
This guide gives general principles. Engage qualified security professionals for design.