07 Close the Path, Keep the Plant Running

Contain the connection. Leave the generation alone.

The right response is narrow. You want to shut the one road the attacker is using, while every approved road stays open. Findavi works through it in seven steps.

1. Spot a device talking outside its normal pattern, such as a gateway controller that suddenly accepts remote logins.
2. Check the customer's own operating rules for that device.
3. Send the finding to the right owner, with a plain summary and one recommended action.
4. Wait for that person's approval, in Approve mode.
5. Act narrowly: block one connection, isolate one port, or push one configuration change.
6. Confirm the unsafe path is closed, and confirm the approved traffic still flows.
7. Record every step, with the time and the approver's name.

The customer chooses the mode for each agent. Observe only watches and reports. Approve acts after a named person says yes. Autonomous acts on rules the customer has already signed off. Any agent can be stopped, rolled back or switched off at any time.

Observed: a live water site. Pilot result, confirmed by NetOps IQ's CTO. Different sector, same kind of control system.

During a pilot at a live water site, the team ran a simulated attack on the plant's controller screens, the screens operators use to run the process. Findavi blocked the attacking connection and isolated a port. Then it ran both checks. The security check passed: the attacking path was closed. The service check passed: the controls kept running for the operator.

A water plant and a power plant run on the same kind of equipment: controllers, operator screens and remote links. The lesson carries over. You can close the dangerous path while the people running the plant keep working.