Eager to fortify its defenses against the unseen operational threats of ever-sophisticated cyber attackers, the global chemical leader turned to Black & Veatch for answers.
Underlying these efforts was the client’s commitment to operating safely and securely into the future. The company recognized that keeping up with increasing demand, staying competitive in a dynamic market and aligning future technology goals with a robust, scalable cybersecurity foundation were essential to its long-term success. These motivations drove the decision to embark on a comprehensive cybersecurity transformation.
After working with different vendors on risk management and vulnerability assessments, the company was ready to start the execution — something previous vendors were lacking experience with. Thanks to its field experience and cybersecurity consulting background, the Black & Veatch team presented a tailored solution that not only addressed the client’s needs but also offered a detailed path forward.
As digitization and connectivity drives today’s operations, adding exposure to cyberattacks, Black & Veatch started by inventorying the client’s operational technology (OT) systems to assess complexities of what’s needed to present the right-sized, customized solution. The goal: enhance OT cybersecurity capabilities at the site level while aligning with enterprise-wide cyber programs through an approach that addressed technology, processes and people.
Given the differences in the client’s OT cybersecurity maturity level and the site-specific needs across its global locations, a one-size-fits-all approach wasn’t reasonable. That’s when the Black & Veatch industrial cybersecurity team presented a phased implementation strategy, enabling the client to implement a scalable, enterprise-wide cyber program with a tailored approach to each site. That solution minimizes operational disruption during implementation, considering the legacy systems running at the local site, while maximizing long-term resilience, ensuring safety, security and operations continuity.
The industrial cybersecurity makeover began with “discovery,” an audit of each site’s assets and cyber posture and identifying vulnerabilities, gaps and needs, aligning with cyber programs across the enterprise. Key personnel were interviewed, and reviews included previous assessments, IT/OT policies, network inventories and topology diagrams, incident reports, change management logs, technology manuals, configurations and backup and storage locations, among others.
The ensuing “network topology” described how devices are interconnected and how data flows between them, which is vital in effectively managing and troubleshooting networks.
Foundational enhancements were presented, considered and approved. The “light touches” focused on low-impact, non-disruptive cybersecurity improvements to enhance the visibility and foundational security without operational disruption. They included establishing a demilitarized zone (DMZ), adopting intrusion detection systems (IDS) and deploying out-of-band network data collection.
Building on these foundational improvements, the team advanced to more comprehensive measures that further strengthened and optimized industrial cybersecurity defenses, enhanced security architecture and reduced the attack surface, leveraging such solutions as network segmentation, secure remote access and process control network (PCN) implementation.
Final touches meant to heighten the client’s cyber maturity addressed outstanding capability to build a robust, sustainable cybersecurity posture while mitigating remaining vulnerabilities and maturing the cybersecurity program. Such solutions involved PCN patching, physical security enhancements and around-the-clock monitoring.
Because regulatory mandates vary by country, Black & Veatch — thanks to its global presence — helped the client navigate those compliance complexities.
While such upgrades can look daunting initially, they've never been more important. The client’s upgrades enabled them to implement global processes and capabilities for ongoing management of assets and industrial security defenses. The program also has established a standard network topology and asset inventory that can be managed as additional changes are adopted.
As the local sites reached the implementation of this first phase, Black & Veatch has prepared the next phase that will allow the client to implement and maintain a global 24/7 remote monitoring program over their OT environment.
In an era in which industrial operations face relentless cyber threats, this investment underscores the power of a strategic, phased approach that both fortifies the client’s OT environment and lays the groundwork for a scalable, enterprise-wide cyber program balancing resilience with operational continuity.
From foundational safeguards to advanced network segmentation and global compliance alignment, these collaborative efforts position the client to operate securely, adapt confidently and continue to thrive in a digitally connected future.
