A security operation built around the shift.
MSS Works Industrial Security provides a Pittsburgh-based managed OT security service for organizations whose physical operations continue outside office hours. The service is designed around continuous monitoring and agreed escalation, with 24/7 coverage defined in the signed service scope. We establish who is on shift, who can authorize a network change, and which conditions require an immediate conversation with the control room.
An alert does not automatically justify isolating a controller. Loss of visibility, unexpected engineering activity, and a suspected malicious command have different operational consequences. Our response model joins security analysis with plant authority. The incident record identifies the evidence, the process potentially affected, the uncertainty, and the requested decision. Operators need a useful next step, with enough context to judge its impact on production.
Deploy sensors without probing the process.
We plan non-intrusive visibility through existing SPAN capabilities or suitable TAPs, considering bandwidth, redundancy, environmental constraints, and installation windows. Passive discovery learns from communications already present on the network. It does not send routine discovery probes into PLCs. A network team still reviews mirror configuration and capacity, and a physical TAP installation may require an approved outage or a compatible bypass arrangement.
An asset inventory records observed addresses, industrial roles, communication relationships, and confidence in each identification. Some devices remain silent for long periods; others communicate behind gateways that hide their identity. We reconcile those observations with engineering records and operator knowledge. A device is not declared absent merely because the sensor has not seen it. Changes to coverage are tracked alongside changes to the inventory.
Turn observations into process-aware investigations.
Analysts review new communication paths, changed engineering clients, unexpected protocol behavior, and departures from the approved maintenance pattern. A control engineer may explain a scheduled logic download; the same action from an unknown workstation may warrant escalation. Tuning uses documented operating context rather than blanket suppression. Repeated false positives are investigated as a monitoring design problem, with their resolution recorded for the next shift.
The evidence package can include relevant packet excerpts, timestamps, sensor health, asset context, and a timeline of related events. Collection and retention are agreed before production onboarding, with access limited to the service roles that need it. Packet payloads may expose process information, so raw captures are handled deliberately. Routine reports explain material changes and unresolved exceptions rather than presenting alert counts as a substitute for risk.
Prepare the response before an incident.
For power environments, we map agreed response tasks to the customer’s applicable NERC CIP obligations and responsible roles. Applicability depends on the registered entity, assets, and current requirements. For water utilities, AWWA J100 can inform an all-hazards risk discussion; it is not a replacement for a detailed cyber response procedure. Neither reference turns a generic playbook into a compliance guarantee.
Playbooks cover scenarios such as compromised remote access, unauthorized controller changes, and loss of reliable telemetry. Each specifies contacts, evidence preservation, containment options, operational approval, and recovery checks. A tabletop exercise tests the handoffs while the plant is stable. Recovery includes verifying trusted configurations and operator visibility, not simply restoring network reachability. Safety and local emergency procedures remain under the customer’s established authority.
Agree on the service boundary.
Onboarding defines sensor ownership, escalation timing, maintenance notifications, access arrangements, and the treatment of outages. It also identifies what we cannot see, including isolated cells and encrypted application content without supporting logs. Contact [email protected] to scope coverage. Existing customers should use their contracted escalation route; [email protected] is a coordination mailbox, and email alone does not establish an emergency response commitment.