IT CISOs Guide to OT: Seeing (or Not Seeing) is Believing with Network Cloaking

(Tom)

In our first post, Vince and I talked about the overwhelming reality of inheriting a legacy industrial facility. It’s exactly like taking ownership of a classic family estate that looks beautiful from the driveway, but holds decades of unmapped electrical patches and structural shortcuts behind the drywall.

When you first sit down with your plant managers and automation engineers to ask how they’ve been keeping this inherited house secure, they will almost always smile, lean back, and give you the exact same answer:

“Don’t worry, our control network is completely air-gapped.”

It sounds incredibly comforting. In their minds, the house is safe because it’s set so far back from the main road, hidden behind a thick tree line, and completely disconnected from the public grid. They believe that because the operational technology (OT) network isn’t hooked up to corporate email, it is functionally unreachable.

It’s time to face reality: the air-gap is a dangerous illusion. It no longer exists

Pulling Back the Drywall on the “Air-Gap”

If you pull back the architectural layers of any modern industrial facility, you quickly realize that those trees protecting the house from the main road were cut down years ago.

In a world driven by real-time telemetry analytics, third-party vendor maintenance agreements, remote OEM troubleshooting, and hyper-connected supply chains, true isolation no longer exists. There are a dozen hidden dirt roads leading straight into your backyard:

• That third-party contractor who plugs a cellular cradle or a dual-homed laptop directly into a switch on the plant floor to fix an HMI.
• The data historian pumping performance metrics up to a corporate dashboard or a cloud analytics environment.
• The legacy remote-access software left running on an engineering workstation so a technician can monitor the facility from home over the weekend.

The house isn’t isolated. It is heavily connected, and the doors are unlocked.

The Danger of Building “Taller Walls”

When an IT CISO discovers these exposed pathways, their traditional enterprise playbook tells them to deploy a massive perimeter defense with what I like to call a “God Box” deployment. They buy expensive, bloated enterprise firewalls with deep packet inspection (DPI) and complex intrusion detection logic at the boundary.

They are essentially building a massive 20-foot concrete wall right on the property line, complete with flashing security lights and armed guards.

But here is the counter-intuitive flaw in that strategy: A taller wall doesn’t make you invisible; it just makes you a landmark.

Enterprise firewalls are complex software systems with their own massive attack surfaces, unpatched vulnerabilities, and management overhead. They still have to listen for incoming connections, which means they actively broadcast their IP addresses to the public internet. If an automated threat actor or a state-sponsored offensive team drives down the digital street scanning for a way in, that massive wall acts as a giant neon sign pointing directly to your crown jewels.

First-Principles Minimalism: Turn Off the Lights

Early in my career, I spent a lot of time analyzing how the defense sector obsessed over hiding high-value networks through strategic obscurity. I learned a fundamental lesson that completely shaped my approach to cybersecurity: If an adversary can see an IP address, they will eventually find a way to exploit it.

Today, advanced persistent threat (APT) groups and automated AI offensive engines use cognitive scanning pipelines to map connected infrastructure in milliseconds. They look for open ports, analyze protocol handshakes, and identify exact firmware versions from miles away. Trying to out-run or out-detect these machine-speed scanners using enterprise logging tools is a losing game.

So, how do we fix it? We don’t build a taller wall around a visible target. We use Network Cloaking to take the target off the map entirely.

[Traditional Security]: Public IP Address ──> Exposed Perimeter Firewall ──> Attacker Can See & Scan Node

[Network Cloaking]: Suppressed Protocols ──> Drop Unauthenticated Packets ──> Asset is 100% Invisible

Instead of allowing your edge devices to answer incoming public requests, BlastWave’s Software-Defined Perimeter (SDP) suppresses external network discovery protocols and forces your interfaces to drop unauthenticated packets.

To an automated port scan, an internal rogue probe, or an AI-driven threat engine, your critical OT assets functionally do not exist. There is no IP address to ping, no port to probe, and no firewall interface to exploit.

We are turning off the lights in the house, pulling down the shades, and erasing the driveway from the GPS map. If the scanners can’t find you, they can’t hack you.

Your First Renovation Milestone

If you are a new CISO staring at an inherited OT network, stop panicking about mapping every single legacy PLC or patching every 15-year-old firmware vulnerability on day one. Your very first action point is structural containment.

Stop the bleeding at the edge. Move past the illusion of the air-gap, bypass the complexity of bloated enterprise boundary firewalls, and cloak your infrastructure. Take your physical facilities off the global target list so you can buy your team the breathing room they need to fix the rest of the house.

In our next post, Vince and I are going to look behind the walls at the plumbing, exploring why the constant pressure of emergency patching is killing your operational uptime, and how to achieve true flexibility without sacrificing security. Stay tuned for Blog 3.