Case study / Cement & building materials

Twelve plants, two owners, one OT network program.

A national cement and building materials producer brought Potenza in to assess one plant's OT network in late 2022. Today the same team assesses, hardens and operates the OT networks of twelve plants, and stayed on through two changes of ownership.

The customer is not named, under the confidentiality terms of the services agreement. Everything on this page comes from the engagement's own reports.

How one plant became twelve

The program grew plant by plant, and it survived two acquisitions. Each new owner inherited the documentation and kept the service.

  1. 2022

    One plant, one site survey

    A field survey of a single cement plant: network rooms, electrical rooms, switch inventory and the first as-built topology. The plant had drawings nobody trusted and a switch estate nobody had listed.

  2. 2023

    Six plants, six essential controls

    The survey became a program across six cement plants. Endpoint protection, firewalls and per-plant OT domain controllers went in, with the same six controls tracked at every site.

  3. 2024

    First change of ownership

    The plants were acquired. Potenza carried the inventories, topologies and bi-annual reporting across to the new owner's standards without a gap in service.

  4. 2025

    Second change of ownership, same team

    Acquired again. Remote access, DNS, domains and licensing moved to the new corporate platform plant by plant, while the recurring service kept running. The year closed with an annual OT report covering every plant.

  5. 2026

    Three new cement plants and three pipe plants

    The new owner asked Potenza to onboard its other facilities. Each one starts with the same field assessment: escorted walkdown, passive observation, config review, and a gap analysis against the corporate OT architecture standard.

What we found, and what is in place now

The exposure was ordinary, which is the point. No exotic attacker was needed. Unsupported switches, cleartext management, shared credentials and flat networks were enough.

Switch estate
Found at assessmentMost OT switches aging or past end of life, several on firmware the vendor no longer patched, and no inventory that matched the racks.
In place todayEvery plant has a maintained inventory with model, firmware and support status, a phased refresh plan, and core switches redesigned where the topology needed it.
Device management
Found at assessmentTelnet and HTTP management on, Smart Install enabled, SNMP v2c with default-style communities, no access control on the management plane, no central logging.
In place todayHardening tracked switch by switch: insecure protocols retired, access-class and syslog applied as each plant's windows allow, and a configuration backup routine for the estate.
Credentials and access
Found at assessmentShared local admin accounts on switches and servers, vendor remote access nobody could list, workstations outside any domain.
In place todayPer-plant OT domain controllers, named accounts in security groups, governed privileged remote access with session traceability, and a written access matrix for every assessment.
Network architecture
Found at assessmentIT and OT sharing hardware, isolated islands at the control system vendor's whim, and obsolete fieldbuses (ControlNet, DeviceNet, DH+) carrying production traffic.
In place todayPhysically separate OT switching where it matters, fieldbus segments migrated to EtherNet/IP at the largest plant, new fiber to the quarry, and as-built L2/L3 diagrams kept current.
Visibility
Found at assessmentOne plant with network monitoring. Everywhere else, outages were discovered by operators.
In place todayOT intrusion detection and endpoint protection across the plants, with Potenza handling the alerts, sensor updates and the follow-up.

The same four moves at every plant

Nothing here is proprietary. The difference is doing it on a live cement plant, with an escort, without touching the control layer.

  1. 01

    Assess

    A field survey measured against a target architecture. Findings are differences, never opinions, and never written against a person.

    • Escorted walkdown of network rooms, control rooms, MCC and electrical rooms
    • Passive traffic observation on a mirror port, nothing injected
    • Read-only configuration review of switches, routers and firewalls
    • Baseline asset inventory, as-built topology, prioritized gap analysis

  2. 02

    Harden

    Template-fixable findings first, because they close the most exposure for the least plant time.

    • Disable Telnet, HTTP management and Smart Install
    • Management access-class, syslog and SNMP hardening
    • Credential rotation, then centralized authentication
    • Firmware to vendor-supported releases, one plant at a time

  3. 03

    Modernize

    Engineering work planned with the plant, scheduled in the plant's windows, documented before and after.

    • Fieldbus to EtherNet/IP migrations in the quarry and the mills
    • Core switch stacks and fiber links where the topology was fragile
    • OT domain controllers, OT servers and a segmented CCTV network
    • Phased hardware refresh for the switches past end of life

  4. 04

    Operate

    Recurring service with a written record of every change, so the next owner, or the next engineer, can pick it up.

    • Service and incident reports for every action, weekly follow-ups
    • Monthly, bi-annual and annual OT reports per plant and for the fleet
    • User, access and remote-session administration
    • Vendor and corporate migrations carried through without downtime

Rules we work under on every site

These are written into the assessment procedure the customer's plants countersign. They are why the work has never stopped a kiln.

From SOP-OT-001, the plant assessment procedure used on this engagement.

  1. 01No configuration is modified on any equipment in operation.
  2. 02Nothing is connected to a PLC, DCS or control backplane port.
  3. 03Passive observation is the default. Any active action needs prior written approval.
  4. 04An operations escort is present at all times. No escort, no entry.
  5. 05Work windows are set by the plant. No work during start-up, mix change or corrective shutdown.
  6. 06Vendor version-locked instruments are not touched, patched or updated.
  7. 07Any plant employee can stop the work at any time, for any reason, and it is never questioned afterwards.

Start with one plant.

That is how this program began. A field assessment of a single site gives you an inventory, a topology and a prioritized gap list in a few weeks.

Schedule a Conversation

See how the approach applies to cement and mining.

The maturity model, the baseline controls and the plant-by-plant method behind this engagement.

Read the cement & mining guide