Overview

Aristi has partnered with multiple Operators of Essential Services (OES) across Critical National Infrastructure (CNI), spanning energy, transport, and other sectors. Within the rail sector, we have delivered comprehensive cybersecurity assessments on complex IT/OT systems prior to deployment, ensuring compliance with industry standards and resilience against evolving threats. An example of our work is provided below to demonstrate the methodology used.

‍

Engagement Scope

Aristi conducted a series of in-depth assessments covering both network-level environments and product-level systems, including:

• Operational systems: signalling, signage, communications, traction power, CCTV, access control, and ventilation.
• Technology stack: Windows and Linux platforms, isolated VMware environments, Siemens PLCs, Cisco firewalls, embedded devices, and a wide range of IT and OT protocols.

This holistic approach supported robust threat modelling, vulnerability identification, and mitigation planning in line with regulatory expectations.

Methodology

The engagement followed a structured, collaborative approach:

1. Initial Scoping & Threat Modelling
   
   • Joint workshops with the client to map the IT/OT attack surface.
   • Manual-led testing methodology, supported by selective tools.
   • Threat modelling of key components and discussion of attack paths prior to execution.
2. Planning & Risk Management
   • Development of detailed test plans, covering scope, methodology, and risk considerations.
   • Alignment with IEC 62443, including targeted testing of systems and Factory Acceptance Test stages.
   • Risk-managed testing across non-production and production systems, conducted out of hours to minimise operational impact.
3. Testing Approach
   • Bespoke methodology combining PTES, OSSTMM, and MITRE ATT&CK for ICS, tailored to OT environments.
   • Assessment of system architecture against the Purdue model for controls and segmentation.
   • Consideration of confidentiality, integrity, and availability priorities specific to OT deployments.
   • Integration of client’s internal security requirements, including ISA/IEC 62443 criteria (e.g., password-based authentication requirements).
4. Execution & Handover
   • Non-destructive testing conducted with client oversight and safeguards.
   • Active participation during regression testing and final handover to live operations.

Key Findings

The assessment uncovered several high-priority risks:

• Weak controls on externally facing systems.
• Insufficient IT/OT boundary segregation and inadequate internal OT segmentation.
• Poor patching practices, leaving Windows systems vulnerable to critical exploits.
• Gaps in cybersecurity governance and unclear ownership of OT security responsibilities.

‍

Outcomes

We supported the client in developing and implementing a remediation roadmap that included:

• Establishing robust IT/OT and intra-OT network segregation to reduce lateral movement.
• Overhauling patch management processes for timely remediation.
• Enhancing cybersecurity governance, including clarified ownership and oversight of OT assets.
• Improved alignment with recognised frameworks (IEC 62443, MITRE ATT&CK, Purdue model).

‍

Impact

The engagement significantly strengthened the client’s cybersecurity posture, improving resilience against both internal and external threats. The tailored assessment not only addressed immediate vulnerabilities but also established the foundations for sustained security maturity across the organisation’s critical infrastructure.