Advancing OT Cyber Security Defense

Migration Study from Vendor A to Vendor B in the Chemical Industry Sector, Including an Implementation Guide

How do a dedicated OT security sensor and a next-generation firewall behave when measured under the same conditions? A reproducible evaluation framework and supporting automation for industrial network security.

Initial situation

Operational Technology (OT) networks run factories, and in a regulated pharmaceutical plant they must keep running safely at all times. These networks are watched by specialised security sensors that passively learn what is normal and raise an alarm when something is not. Replacing such a purpose-built sensor with the security features already inside a general-purpose firewall would cut cost and hardware, but it risks missing threats the dedicated sensor would have caught. This project asks a simple question with a hard answer: are the two really equivalent?

Problem statement / Project goal

Instead of comparing datasheets, the study measures. A vendor-neutral test framework replays the exact same recorded and synthetic network traffic against both systems and scores what each one detects. The scoring is grounded in the international OT security standard IEC 62443 and organised into seven weighted key performance indicators. Because every test is deterministic and replayed identically, the results are reproducible and the comparison is fair.

KPI	Name	Weight
1	Passive Asset Visibility	5
2	Protocol Command Granularity	5
3	Baseline Deviation Detection	5
4	False Positive Resilience	4
5	Vulnerability Correlation	3
6	Fragmentation Evasion	2
7	DNS Tunneling Detection	2

Solution developed and its benefits

The project delivered two pieces of engineered software. The first is the evaluation framework itself: an appliance-agnostic test suite of roughly fifty thousand lines of code that generates attack traffic, replays it, scores the outcome, and presents everything through a web dashboard. A second security appliance can be added without changing the scoring. The second deliverable is an operator tool that automates the most frequent and error-prone manual configuration tasks introduced by the migration, turning work that took hours into minutes.

The evaluation maps where the two systems behave alike and where they diverge. Observed differences fall into two kinds: those that can be addressed with per-site configuration, and those that follow from each platform's architecture. Any migration decision therefore needs a planned, site-specific process rather than a simple swap.

Key terms

• OT CybersecurityProtecting industrial control networks that run production plants.
• IEC 62443International standard used as the basis for the weighted KPI scoring.
• PCAP replayDeterministic replay of recorded and synthetic traffic against both appliances.
• Deep packet inspectionProtocol-aware analysis of industrial traffic beyond headers alone.
• Next-generation firewallNGFW evaluated as a possible sensor replacement.
• Intrusion detectionIIDS sensor used as the dedicated OT baseline.
• Security automationOperator tool (SvelteKit, TypeScript, Tailwind) for migration workflows.
• Test frameworkPython and Scapy suite with appliance REST APIs and a scoring dashboard.

Customer

F. Hoffmann-La Roche AG
www.roche.com

Team

Index image generated with Gemini Banana AI.