Utilities

Physical Isolation for Power Grid and Utility SCADA

Utility networks bridge physical infrastructure and digital control. When those control paths are compromised, the consequences extend far beyond data loss to affect millions of people who depend on essential services.

Back to Control

Utilities

When utility control systems are reachable from corporate networks or the internet, every software vulnerability becomes a potential service disruption affecting millions of people.

100%

SCADA path isolation from corporate IT

Zero

Persistent remote access to control systems

Control modules deployed per utility zone

Full

NIS2 and NERC CIP compliance evidence

The Challenge

Utility control systems face converging threats.

IT/OT Convergence

Smart grid modernisation creates network paths between corporate IT and operational technology that attackers traverse to reach control systems.

Legacy SCADA Systems

Decades-old SCADA and RTU equipment lacks modern security capabilities and cannot be patched without risking operational disruption.

Smart Meter Attack Surface

Advanced metering infrastructure creates millions of network endpoints that expand the attack surface into previously isolated distribution networks.

The Scenario

Scenario: Smart Grid Supply Chain Attack

Attackers compromise a firmware update server for smart meter head-end systems. The malicious update propagates to distribution management systems through the AMI network, eventually reaching SCADA workstations via shared network segments. Operators lose visibility into distribution grid status across an entire region. Restoration takes nine days because backup SCADA configurations were stored on network-attached infrastructure that was also compromised. With Firevault Control, the AMI network is physically separated from SCADA systems. Verified control-plane baselines are held on infrastructure that has no live network path to production and require multi-party authorisation to release. The compromised firmware cannot traverse into control systems because the network path does not exist.

"Our penetration test showed that from a compromised smart meter head-end, there were only three hops to the SCADA master. Three hops between a meter and the ability to open breakers across the distribution network."

Module deployment · utility network

Where each Control module is deployed across a utility network.

Utility estates run along the Purdue model: cloud and corporate at the top, an industrial DMZ in the middle, supervisory and basic control below it, and the physical plant at the bottom. Control puts a real boundary at every level so a problem on one side does not become a problem on the others.

Grounded in NIST SP 800-82 Rev. 3, IEC 62443-3-2, NERC CIP-005 and ENISA Smart Grid guidance.

Cloud / Internet DMZ

External

Customer portal

Cloud services

Public reach, untrusted by default.

FirebreakValidate

Public traffic terminates in the DMZ, not in the office.

Enterprise

SOCDetect, respond

SIEM

Active Directory

AMI head-endMeter billing

Office network and customer systems. Not part of operations.

IsolateFirebreak

Office estate cannot reach the industrial DMZ on its own.

L3.5

Industrial DMZ

DMZ · trust boundary

Jump server

Patch & AV

Data broker

Brokered exchange between IT and OT. No straight-through paths.

RelayValidateExecute

Data and commands cross the DMZ on scheduled, approved routes.

Operations systems

Historian

Engineering workstation

MES

Operational records and engineering tools.

IsolateLock

Operations systems and SCADA sit on separate fabrics.

Supervisory control

Distribution SCADA

HMI

Control room view of the grid.

IsolateExecute

Control commands need approval before they reach substations.

Basic control

Field

Substation RTUs

Protection relays

PLCs

Substations, breakers, feeders.

Lock

Field devices ties to named engineers.

Physical

Field

Sensors

Switchgear

Transformers

OSS

Crown jewels

Off-network

Detail callout · A

Offline Secure Storage

Grid configurations, protection relay settings, network maps and the recovery sets you need to rebuild from a known-good state.

Offline by design · secure by default

Modules & symbols

FirebreakPhysical sever

ValidateIntegrity check

IsolateZone boundary

RelayTime-bound path

ExecuteApproved action

LockNamed access

DMZ boundaryTrust transition

OSS calloutOff-network detail

Where each module is deployed, and what it does there.

One row per module. Placement on the network, then plain-English purpose at that point.

Isolate

At every Purdue boundary

Each level sits on its own physical fabric. A misconfigured rule on the corporate side cannot create a path into SCADA or the substations.
Firebreak

On the L5 to L4 link and the L4 to L3.5 link

Firebreak gives operations a hardware off switch on the public and office boundaries, so a compromise in enterprise cannot ride a live cable into the grid.
Validate

On the L5 to L4 link, and inside the L3.5 DMZ

Before any request crosses into the office or down into operations, Validate checks origin, integrity and authority. Unsigned or unexpected traffic does not progress.
Relay

Inside the L3.5 DMZ

Data flows from L4 into L3 inside scheduled, defined routes. Nothing streams unattended.
Execute

Inside the L3.5 DMZ and on the L2 to L1 link

Firmware, configuration and control actions hold until the right approval is in place. Single clicks do not move grid kit.
Lock

On the L3 to L2 link and the L1 to L0 link

The closer you get to the physical plant, the tighter the named access. Standing access into substations is the exception.

Featured In

Key Capabilities

Sovereign Grid Data

All utility control data remains within the agreed jurisdiction in NATO-approved Firevault Bunkers, ensuring sovereign control over national energy infrastructure data.

Multi-Party Control

Critical operations require authorisation from both control room operators and security teams, preventing unilateral access to grid control systems.

Regulatory Evidence

Automated compliance logging generates continuous evidence for NIS2, NERC CIP, and Ofgem security requirements.

Cellular Failover

Out-of-band management ensures control plane access even when primary utility communications networks are compromised.

Tamper-Proof Logging

Every access, configuration change, and control command is recorded in immutable logs on physically separate infrastructure.

Verified Configuration Baselines

Verified baselines of all grid configuration enable restoration of control-plane state during total compromise scenarios.

Demo to Live

Adoption Guide

Step 1

Utility Network Assessment

Map all network paths between corporate IT, SCADA, AMI, and distribution management systems to identify convergence points and persistent connections.

Step 2

Zone Architecture Design

Design physically separated zones aligned to your utility operations with appropriate Control modules at each boundary.

Step 3

Non-Production Pilot

Deploy in a test environment mirroring your SCADA architecture with full zone separation, multi-party authorisation, and compliance logging.

Step 4

Operational Deployment

Full deployment across utility infrastructure with verified configuration baselines, continuous compliance evidence, and 24/7 out-of-band management.

Step 1

Utility Network Assessment

Map all network paths between corporate IT, SCADA, AMI, and distribution management systems to identify convergence points and persistent connections.

Step 2