A logistics company segments its warehouse and OT network after a ransomware near-miss

A regional logistics company with four distribution centers had a close call. Ransomware reached an office file server and was stopped by luck, hours before it could cross into the warehouses. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite.

The reason it could have spread was a flat network. Office PCs, handheld scanners, conveyor and sortation controllers, and the Windows screens (human-machine interfaces, or HMIs) that operators use to run the line all shared the same address space. Our team started with a passive inventory, built from switch tables and traffic rather than active scans, because some controllers fail when they are probed. The inventory showed which devices existed, what they talked to and which of those conversations were needed.

The design borrowed the Purdue model, the layered reference that industrial standards such as ISA/IEC 62443 use. The office network sat at the top, a demilitarized zone held shared services, site operations such as the warehouse management system formed the middle, and the supervisory HMIs and controllers sat at the bottom. Each function got its own VLAN, and a firewall zone sat between each pair, set to deny everything except a short list of named flows. A conveyor controller does not need to talk to email, so it no longer can.

The Windows HMIs and servers could not be patched on the office schedule, so they got endpoint detection and response (EDR) software, tuned with the vendor's support team to avoid disrupting a running line. Vendor remote access moved to one jump host with multi-factor authentication, session recording and time-limited approval. Cutover went one site at a time in a low-volume window, with a tested rollback at each step.

The team then replayed the near-miss as a tabletop exercise against the new design: an infected office laptop could no longer reach the floor, and every flow that crossed a zone was logged and had an owner. Operators noticed no change in how the line runs. This is a technical design, not a certification, and the company decides when to extend it to its other sites.