+91 9225518517

National Reservoirs

OT Cyber Security Proposals — Zero-Trust for dams, spillways, hydropower & telemetry

National Reservoirs Networks

We harden dam & reservoir OT with network cloaking (virtual air-gap), passwordless MFA, and software-defined microsegmentation, delivering phishing-resistant remote maintenance without exposing public IPs or widening your attack surface.

Network Cloaking (Virtual Air-Gap)

Hide OT hosts from internet recon. Only trusted, authenticated users can even “see” targets.

Passwordless MFA (Phishing-Resistant)

Secure access via Mobile Authenticator or FIDO2 keys—no passwords to phish or reuse.

Microsegmentation (Limit Blast Radius)

Device-level policy isolates PLCs, HMIs & gateways—stops lateral movement on flat L2.

How we secure National Reservoirs

BlastWave-aligned approach

Make OT invisible: cloak dam SCADA/HMIs, RTUs, PLCs, gateways.
Verify then connect: passwordless MFA (mobile/FIDO2), device posture, least-privilege.
Contain failures: microsegment pump houses, spillway gates, hydropower units.
No IP changes: drop in at the OT DMZ; preserve existing addressing/routes.

Remote maintenance workflow (operators & vendors)

User opens BlastShield Desktop Client & chooses Mobile App or FIDO2 authentication.
Scan QR on mobile; biometric confirms identity; ephemeral credentials minted.
Policy grants access only to approved assets (e.g., Gate-PLC/HMI) for a limited window.
Launch Orchestrator for session visibility, policy objects, and audit trails.

Operations & compliance

Session logging for regulator audits; vendor access is time-bound & device-scoped.
Legacy device protection—wrap unpatchable PLCs without inline changes.
Supports hybrid topologies (reservoirs, pumping stations, control rooms, SOC/NOC).

Reservoir OT Asset — Risk & Control Matrix

Asset / Location	Purdue Layer	Key Risks	Controls (BlastWave)	Success Metrics
Dam SCADA / Control Room HMI	L2–L3	Phishing, recon, lateral movement	Cloaking + passwordless MFA; HMI-only policy; audited sessions	0 internet-exposed IPs; 100% MFA; no shared creds
Spillway Gate PLCs / RTUs	L1–L2	Legacy firmware, flat network pivot	Microsegmentation per device/group; vendor time-boxed access	No cross-cell reachability; per-session approver log
Water-Level Sensors / Telemetry	L0–L1	Spoofing, unauthorized polling	Service-scoped policies (protocol/port); cloaked endpoints	Only approved pollers; denied scans
Pumping Stations / Aux Plants	L1–L3	Remote vendor risk	Passwordless vendor access; per-asset entitlements; recording	JIT access SLA; vendor MFA compliance
SOC/NOC & OT DMZ	L3.5	Exposed jump hosts, VPN sprawl	Cloaked gateways; policy-as-code; no VPNs	No open ports; least-privilege reachability graph

30–90 Day Pilot Plan (Reservoir)

Week	Scope	Activities	Deliverables
1–2	OT DMZ & Control Room	Deploy gateway; enroll 10 users; cloak HMI/SCADA	PoC runbook; access policy; success KPIs
3–4	Spillway & Pumps	Microsegment 2 PLC groups; vendor JIT access	Reachability map; vendor audit trail
5–8	Scale & Handover	Expand to telemetry sites; train operators; SOC dashboards	Pilot report; cut-over plan; ROM (Return on Mitigation)