Challenge & Approach

• Challenge: Vulnerabilities in PLC Access and User Identification
  

• Water facility control systems operate on isolated, closed networks. Standard IT authentication methods, which rely on real-time server communication, simply don't work in these environments. Consequently, operators had to share static passwords to access engineering software. Without individual authentication, it was nearly impossible to identify exactly who was logging in, making it difficult to prevent unauthorised access or track connection histories.
• 
  K-water needed a reliable authentication and auditing solution tailored for OT environments, ensuring zero disruption to existing equipment.

• Key Objectives

• Solution: User Authentication Optimised for OT Environments
  

• SSenStone addressed this by implementing OTAC (One-Time Authentication Code) technology. OTAC generates and verifies dynamic codes directly on the device, enabling user identification even when offline. By requiring a unique, one-time code for each operator, the system completely removes the risks associated with shared passwords whilst logging user and authentication data in real time.
• 
  Crucially, the solution was deployed as a front-end OTAC Gateway. This fulfilled all security requirements with zero downtime or operational risk, completely bypassing the need to replace PLC equipment or alter network configurations.
  

• Key Implementation Details

• ✓ Networkless authentication using one-time dynamic codes (OTAC)
  ✓ Real-time, identity-based equipment access control
  ✓ Comprehensive audit logs tracking user details and access history
  ✓ Seamless integration without replacing PLCs or altering network settings

Implementation

• A Field-Tested Implementation Process
  

• ① Site survey → ② Environment analysis → ③ Official testing → ④ Field verification → ⑤ Policy optimisation
• 
  The project was rolled out in phases to perfectly align with the realities of water facility operations. After conducting thorough site surveys and environment analyses, the system's viability was proven through rigorous official testing and field verification. Post-deployment, operational data was used to fine-tune policies, resulting in a bespoke authentication system ideally suited to the site.