IT CISOs Guide to OT: Seeing (or Not Seeing) is Believing with Network Cloaking
(Tom)
In our first post, Vince and I talked about the overwhelming reality of inheriting a legacy industrial facility. It’s exactly like taking ownership of a classic family estate that looks beautiful from the driveway, but holds decades of unmapped electrical patches and structural shortcuts behind the drywall.
When you first sit down with your plant managers and automation engineers to ask how they’ve been keeping this inherited house secure, they will almost always smile, lean back, and give you the exact same answer:
“Don’t worry, our control network is completely air-gapped.”
It sounds incredibly comforting. In their minds, the house is safe because it’s set so far back from the main road, hidden behind a thick tree line, and completely disconnected from the public grid. They believe that because the operational technology (OT) network isn't hooked up to corporate email, it is functionally unreachable.
It’s time to face reality: the air-gap is a dangerous illusion. It no longer exists
Pulling Back the Drywall on the "Air-Gap"
If you pull back the architectural layers of any modern industrial facility, you quickly realize that those trees protecting the house from the main road were cut down years ago.
In a world driven by real-time telemetry analytics, third-party vendor maintenance agreements, remote OEM troubleshooting, and hyper-connected supply chains, true isolation no longer exists. There are a dozen hidden dirt roads leading straight into your backyard:
- That third-party contractor who plugs a cellular cradle or a dual-homed laptop directly into a switch on the plant floor to fix an HMI.
- The data historian pumping performance metrics up to a corporate dashboard or a cloud analytics environment.
- The legacy remote-access software left running on an engineering workstation so a technician can monitor the facility from home over the weekend.
The house isn’t isolated. It is heavily connected, and the doors are unlocked.
The Danger of Building "Taller Walls"
When an IT CISO discovers these exposed pathways, their traditional enterprise playbook tells them to deploy a massive perimeter defense with what I like to call a "God Box" deployment. They buy expensive, bloated enterprise firewalls with deep packet inspection (DPI) and complex intrusion detection logic at the boundary.
They are essentially building a massive 20-foot concrete wall right on the property line, complete with flashing security lights and armed guards.
But here is the counter-intuitive flaw in that strategy: A taller wall doesn't make you invisible; it just makes you a landmark.
Enterprise firewalls are complex software systems with their own massive attack surfaces, unpatched vulnerabilities, and management overhead. They still have to listen for incoming connections, which means they actively broadcast their IP addresses to the public internet. If an automated threat actor or a state-sponsored offensive team drives down the digital street scanning for a way in, that massive wall acts as a giant neon sign pointing directly to your crown jewels.
First-Principles Minimalism: Turn Off the Lights
Early in my career, I spent a lot of time analyzing how the defense sector obsessed over hiding high-value networks through strategic obscurity. I learned a fundamental lesson that completely shaped my approach to cybersecurity: If an adversary can see an IP address, they will eventually find a way to exploit it.
Today, advanced persistent threat (APT) groups and automated AI offensive engines use cognitive scanning pipelines to map connected infrastructure in milliseconds. They look for open ports, analyze protocol handshakes, and identify exact firmware versions from miles away. Trying to out-run or out-detect these machine-speed scanners using enterprise logging tools is a losing game.
So, how do we fix it? We don't build a taller wall around a visible target. We use Network Cloaking to take the target off the map entirely.
[Traditional Security]: Public IP Address ──> Exposed Perimeter Firewall ──> Attacker Can See & Scan Node
[Network Cloaking]: Suppressed Protocols ──> Drop Unauthenticated Packets ──> Asset is 100% Invisible
Instead of allowing your edge devices to answer incoming public requests, BlastWave’s Software-Defined Perimeter (SDP) suppresses external network discovery protocols and forces your interfaces to drop unauthenticated packets.
To an automated port scan, an internal rogue probe, or an AI-driven threat engine, your critical OT assets functionally do not exist. There is no IP address to ping, no port to probe, and no firewall interface to exploit.
We are turning off the lights in the house, pulling down the shades, and erasing the driveway from the GPS map. If the scanners can’t find you, they can’t hack you.
Your First Renovation Milestone
If you are a new CISO staring at an inherited OT network, stop panicking about mapping every single legacy PLC or patching every 15-year-old firmware vulnerability on day one. Your very first action point is structural containment.
Stop the bleeding at the edge. Move past the illusion of the air-gap, bypass the complexity of bloated enterprise boundary firewalls, and cloak your infrastructure. Take your physical facilities off the global target list so you can buy your team the breathing room they need to fix the rest of the house.
In our next post, Vince and I are going to look behind the walls at the plumbing, exploring why the constant pressure of emergency patching is killing your operational uptime, and how to achieve true flexibility without sacrificing security. Stay tuned for Blog 3.
Frequently Asked Questions
What is network cloaking in OT cybersecurity?
Network cloaking is a security approach that makes operational technology systems invisible to unauthorized users, scanners, and threat actors. It suppresses network discovery, drops unauthenticated traffic, and prevents exposed assets from responding to probes.
Why are traditional OT air gaps no longer reliable?
Most modern OT environments are connected through remote maintenance tools, cellular devices, cloud analytics, data historians, vendor laptops, and corporate dashboards. These connections create hidden pathways into networks that may still be described as air-gapped.
How does network cloaking reduce the OT attack surface?
Network cloaking prevents attackers from discovering IP addresses, open ports, services, and network topology. Because unauthorized scans receive no useful response, attackers cannot easily identify or target vulnerable OT assets.
How is network cloaking different from a firewall?
A traditional firewall protects a visible network boundary by inspecting and filtering traffic. Network cloaking removes protected systems from unauthorized view and rejects unauthenticated connection attempts before those systems can be scanned or probed.
Can network cloaking protect legacy OT systems?
Yes. Network cloaking can protect legacy PLCs, HMIs, controllers, and other systems that are difficult or impossible to patch by placing them behind a secure software-defined perimeter. This reduces exposure without requiring immediate replacement or major changes to the underlying equipment.
Does network cloaking replace network segmentation?
No. Network cloaking and segmentation solve different problems. Cloaking prevents unauthorized discovery and initial access, while segmentation limits communication and lateral movement between systems after access is granted.
How does network cloaking help defend against AI-powered cyberattacks?
AI-powered tools can scan networks, identify exposed services, analyze protocol responses, and locate vulnerabilities at machine speed. Network cloaking deprives these tools of the visibility and reconnaissance data they need to select and attack a target.
What should a CISO do first after inheriting an OT network?
The first priority should be structural containment. Identify exposed pathways, restrict unauthorized access, cloak critical OT assets, and create a secure boundary that gives the security team time to assess, segment, and modernize the environment.
How to Cloak an Inherited OT Network
Step 1: Identify every connection into the OT environment
Document known and informal access paths, including vendor laptops, cellular connections, remote desktop tools, data historians, cloud integrations, engineering workstations, and IT-to-OT links.
Step 2: Validate the claimed air gap
Do not assume the OT network is isolated. Test whether systems can communicate with corporate networks, cloud platforms, third-party services, or remote users.
Step 3: Locate exposed OT assets and interfaces
Identify public-facing IP addresses, open ports, remote-access services, firewall interfaces, and systems that respond to network discovery or scanning.
Step 4: Place critical systems behind a software-defined perimeter
Deploy network cloaking at the edge of the OT environment so protected assets do not respond to unauthorized scans, connection attempts, or discovery protocols.
Step 5: Require authentication before network access
Configure the environment so users and devices must be verified before they can see or communicate with protected OT resources.
Step 6: Drop unauthenticated traffic by default
Use deny-by-default policies so unsolicited packets are rejected rather than passed to visible services or exposed firewall interfaces.
Step 7: Grant access according to role and operational need
Allow engineers, operators, vendors, and contractors to access only the systems required for their work. Avoid broad network-level access.
Step 8: Combine cloaking with segmentation
Create isolated zones for critical systems, production lines, facilities, and user groups to limit lateral movement if an account or endpoint is compromised.
Step 9: Monitor without exposing the network
Maintain logging, alerting, and operational visibility for authorized administrators while keeping protected systems undiscoverable to unauthorized users.
Step 10: Modernize the environment in phases
Once the OT network is contained and cloaked, begin addressing legacy firmware, insecure remote-access tools, undocumented connections, and outdated systems according to operational risk and business priority.
REvil’s Kaseya attack showed how trusted tools can become attack paths. BlastWave explains why Zero Trust and network cloaking protect OT environments worldwide.
Explore the complete analysis of 23 OT attacks that defeated firewalls, VPNs, and air gaps.
.svg)
.svg)
.jpg)