At a reverse osmosis (SWRO) desalination plant in Taiwan, MIESA has designed, developed and implemented a complete automation and OT cybersecurity architecture based on Siemens PCS 7. We treated industrial control and cybersecurity as parts of the same engineering: from defining the solution to programming, integration and evidence for audits.
- ~4,000I/O signals integrated in PCS 7
- 2physical servers with redundant Hyper-V virtualisation
- 3segmented OT zones: control, supervision and DMZ
- 5engineering layers, from the process to the documentation
The architecture, block by block
Select each block to see what it includes. The levels run from the process (bottom) to the most exposed zone (top); engineering and documentation span the whole architecture.
Block 01
Process control — DCS
The control system of the reverse osmosis plant, with redundancy at the critical points.
- Siemens PCS 7
- Redundant automation systems with CPU 410H
- SIMATIC ET 200SP distributed I/O
- Approximately 4,000 I/O signals
- Integration of process signals and instrumentation
Block 02
Redundant virtualised infrastructure
Server platform designed for the availability of the industrial system.
- Hyper-V on two redundant physical servers
- Virtual engineering, operator and process historian servers
- Storage and recovery infrastructure
- Design focused on continuity of operation
Block 03
OT segmentation and protection
The network is split into control, supervision and industrial DMZ zones, with controlled communications between them.
- Stormshield firewalls to protect and segment the OT network
- Separate control, supervision and industrial DMZ zones
- Communications between zones limited to the flows required
- Secure remote access via VPN and Jump Server
Block 04
Monitoring and cybersecurity
Continuous visibility of the OT infrastructure and of security events.
- Siemens SINEC NMS to supervise the network infrastructure
- SINEC Security Monitor for security events and anomaly detection
- IDS sensors with passive inspection of industrial traffic
- Multi-factor authentication (MFA) with FortiAuthenticator
- Inventory and visibility of connected assets with FortiNAC
- Backup and recovery of OT systems
Block 05
Engineering and technical documentation
The engineering work that turns the architecture into a real, operable and auditable system.
- Design and definition of the solution
- Systems engineering and configuration
- Programming and integration
- Implementation of OT cybersecurity controls
- Hardening, access management and recovery procedures
- Documentation and technical evidence for audits
Programming and control
Programming and integration of the PCS 7 system with redundant CPU 410H controllers and ET 200SP I/O, integrating the plant’s process instrumentation. Engineering, operator and historian servers virtualised on Hyper-V to maximise availability.
ICS infrastructure design
We designed the entire industrial control system (ICS) infrastructure, with redundancy at every layer:
- Sizing of computing capacity: server cores and RAM
- Sizing of storage: SAN for virtual machines and NAS for backups
- Redundant ICS architecture: servers, network, controllers and storage
OT cybersecurity
We designed the ICS architecture with cybersecurity built in from the start and installed it ourselves: zone segmentation with Stormshield firewalls, remote access via VPN and Jump Server, monitoring with SINEC NMS and SINEC Security Monitor, passive intrusion detection (IDS) on industrial traffic, multi-factor authentication (MFA) with FortiAuthenticator, asset inventory and network access control with FortiNAC, and backup and recovery of the OT systems.
Deliverables
- Network and security architectures
- Systems engineering and configuration
- Hardening procedures
- Access and user management
- Backup and recovery procedures
- Documentation and technical evidence for audits