How to read these briefs.
These anonymised, illustrative architecture briefs describe representative engineering problems rather than verified customer results. Names, network details, and deployment outcomes are intentionally absent. Each brief explains the operational constraint, a proposed boundary, and the evidence an acceptance review should request. They provide a starting point for discussion with MSS Works Industrial Security, not a claim that the same design is appropriate for every facility.
01 / Midwest rolling mill: isolate the programming path.
A rolling mill relies on legacy PLCs, supervisory stations, and a small number of engineering workstations. Production reporting has gradually accumulated access into the same address space. The concern is a corporate ransomware event reaching programming services through a trusted workstation or shared administration route. The operating constraint is equally clear: mill coordination and established control timing must continue through any network change.
The proposed design separates rolling stands into operationally meaningful cells and keeps essential local exchanges inside them. Named engineering workstations reach programming services through controlled conduits during approved maintenance. A site historian supplies a reporting replica through the industrial DMZ. Direct enterprise access to controllers is removed, and maintenance laptops enter through a reviewed process rather than an available switch port.
Acceptance should include recorded production baselines, tested engineering workflows, verified controller backups, and proof that alternate routes do not bypass the boundary. Startup, recipe change, and recovery states belong in the test plan. The review asks whether operators can restore a failed station without reopening general access. Success is demonstrated by observed permitted behavior and rejected unauthorized paths, not by the number of firewall rules installed.
02 / Municipal SCADA: harden the cellular backhaul.
A municipal water system collects telemetry from remote stations over cellular links. The cellular service provides transport, while pumps and treatment decisions still require reliable local behavior. An address that appears private is not, by itself, an authenticated control relationship. The design question is how to constrain access to each station without making safe operation depend on uninterrupted backhaul connectivity.
The proposed architecture authenticates the communications gateway, restricts master-to-outstation relationships, and separates device administration from routine SCADA traffic. DNP3 or Modbus behavior is reviewed against station roles. Local controllers retain the documented operating response when communications fail. Remote maintenance uses a deliberate, time-limited access workflow with named approval and a record of the affected station.
Acceptance covers communications loss, reconnection, clock consistency, queued events, and the operator’s ability to distinguish stale values from current measurements. The control team validates safe local behavior independently of the security gateway. A response playbook explains who can disable a suspect remote session and how the duty operator confirms that the station remains in its expected operating mode.
03 / Regional cold storage: separate the chiller boundary.
A cold-storage operation wants enterprise visibility into ammonia chiller performance without exposing refrigeration controls to ordinary business systems. Temperature reporting, contractor maintenance, and safety-related functions have different requirements. Calling the whole installation “air-gapped” while a reporting cable remains connected would hide the real trust boundary. The design must describe the separation accurately and preserve the established protection functions.
One proposed arrangement keeps refrigeration control local and exports a compatible historian feed through a hardware data diode into the DMZ. This is unidirectional connectivity, not a literal air gap. Where an actual air gap is required, reporting instead needs an approved offline transfer process. Contractor access is treated as a separate engineering decision, with local authorization and no assumed return path through the export gateway.
Acceptance examines reporting delay, lost export data, gateway recovery, and the distinction between chiller operation and enterprise dashboard availability. Safety functions remain subject to their own qualified review. The final handover states exactly which cables and services cross each boundary, who owns them, and what happens when they fail. A label on a network diagram cannot substitute for that operating evidence.