Skip to main content

Cybersecurity for Dairy Processing

Dairy Processing Plant

Site-Wide Active Protection with Operational Dashboard​

Background​

Modern dairy processing plants operate complex, highly automated production environments. Multiple production lines — from milk reception and pasteurisation through to powder drying and packaging — are governed by interconnected SCADA systems, PLCs, HMI clients, historians, and MES platforms.

These facilities typically have limited on-site cybersecurity expertise. A small automation engineering team manages the entire OT environment, often supported by numerous third-party contractors who require regular access for maintenance, upgrades, and commissioning activities.

The combination of extensive automation, third-party access, and limited cybersecurity resources creates a significant risk exposure — one that traditional IT security tools are not designed to address.

Customer Profile​

  • Large-scale dairy processing facility with multiple production lines
  • Production servers, HMI clients, historians, and MES systems
  • Small automation engineering team with no dedicated cybersecurity staff
  • Numerous third-party contractors with regular site access
  • PLCs, RTUs, and OT network infrastructure across the plant

The Challenge​

The plant recognised that its OT environment lacked real-time cybersecurity visibility and active protection. Specific concerns included:

  • No visibility into what software was running on SCADA workstations and production servers
  • No control over PLC programming access — any engineering workstation could potentially modify controller logic
  • Third-party contractor risk — vendors connecting to the OT network for maintenance introduced uncontrolled endpoints and potential malware vectors
  • No real-time cyber posture awareness — plant management and control room operators had no way to assess the current state of cybersecurity across the facility
  • Periodic security audits were insufficient — assessments conducted every few years left long intervals of unmonitored exposure

The plant needed a solution that would provide continuous, autonomous protection without requiring a dedicated cybersecurity team to operate.

The Solution — Site-Wide Active Protection​

First Watch was deployed across the entire facility, providing layered protection from endpoints to network communications:

ControlGuard — Endpoint Protection​

ControlGuard agents were installed on all critical Windows systems across the plant:

  • Production servers (Windows Server 2019) — protecting historians, MES, and application servers
  • HMI and engineering PCs (Windows 10/11) — securing operator workstations and engineering tools across all production areas

ControlGuard ensures that only approved, whitelisted applications are permitted to execute. Any unauthorised software — whether introduced by a contractor, downloaded inadvertently, or delivered via malware — is blocked before it can run.

PLC Guard — Network Protection​

PLC Guard appliances were deployed across critical OT network segments to provide deep packet inspection of industrial protocol traffic:

  • Authorised communication enforcement — only approved hosts can communicate with PLCs
  • Programming protection — unauthorised attempts to download logic, update firmware, or modify PLC configurations are blocked
  • Process variable monitoring — visibility into read/write operations to ensure process integrity

Controller — Central Management and Dashboard​

The First Watch Controller provides centralised event collection, alarm management, policy distribution, and — critically for this deployment — real-time operational dashboards.

Control Room Dashboard — Operational Cyber Posture​

A key requirement for this deployment was providing the plant's control room operators and management with continuous, real-time visibility into the facility's cybersecurity posture — without requiring cybersecurity expertise to interpret.

First Watch Control Room Dashboard

The First Watch dashboard, installed on a dedicated screen in the control room, provides:

At-a-Glance Cyber Posture​

  • Overall protection status — a clear, immediate indication of whether the plant is operating within its approved security baseline
  • Active alarm summary — current alarms grouped by severity, enabling operators to see at a glance whether any security events require attention
  • Asset protection coverage — visibility into how many assets are protected, monitored, and verified across the facility

Real-Time Event Visibility​

  • Live event feed — as events occur across the plant, they appear on the dashboard in near real time
  • Policy enforcement status — confirmation that active protection policies are enforced and functioning correctly
  • Agent health monitoring — visibility into the operational status of all ControlGuard agents and PLC Guard appliances, ensuring no gaps in coverage

Operational Context​

  • Asset inventory overview — the dashboard presents the current state of all managed assets, including hardware, software, and firmware details
  • Change detection indicators — any changes detected across protected assets are surfaced immediately, allowing operators to verify whether they correspond to approved maintenance activities
  • Alarm trends and history — historical views that support shift handover briefings and management reporting

Enabling Non-Specialist Operators​

The dashboard is deliberately designed to be understandable by control room operators — not just cybersecurity specialists. The visual presentation uses clear status indicators, severity-based colour coding, and structured layouts that align with how operators already monitor process alarms and plant status.

This means that the same team monitoring production can also maintain awareness of the plant's cyber posture, escalating to engineering or management only when a genuine issue requires attention.

Monthly Security Operations Reporting​

In addition to the real-time dashboard, First Watch provides a monthly Security Operations Centre (SOC) report covering:

  • Current cyber posture assessment and trends
  • Summary of alarms, events, and enforcement actions
  • Recommended remedial actions for any identified issues
  • Cyber incident documentation where applicable
  • Proposed action plan for continuous cybersecurity improvement

This report supports regular governance meetings and provides documented evidence of ongoing cybersecurity management for compliance and audit purposes.

What We Monitor — Dairy Processing Specifics​

Dairy processing plants rely on industrial automation to maintain product quality, safety, and regulatory compliance. First Watch provides deep visibility into the specific operations that matter in this environment.

Production System Protection​

  • Recipe and batch parameters — monitoring changes to production recipes, batch sequencing, and quality parameters that directly affect product output
  • Pasteurisation and CIP setpoints — detecting unauthorised modifications to temperature, flow, and timing parameters critical to food safety
  • Packaging line configurations — visibility into changes to labelling, weight, and packaging control logic

PLC and Controller Monitoring​

  • Program download and upload — blocking unauthorised logic changes to PLCs governing critical production processes
  • Firmware updates — preventing uncontrolled firmware modifications that could affect controller behaviour
  • Engineering session tracking — logging all programming connections with timestamps, source identification, and user attribution
  • Mode changes — alarming on PLC mode transitions outside approved maintenance windows

Third-Party Contractor Controls​

  • Contractor workstation visibility — detecting when new or unrecognised devices connect to the OT network
  • Software execution control — preventing contractor laptops from running unauthorised tools or applications on the plant network
  • Activity logging — full attribution of all actions performed during contractor access windows

Benefits​

For the Plant​

  • Real-time cyber posture visibility in the control room — no specialist interpretation required
  • Autonomous protection — the platform blocks threats without requiring manual intervention
  • Third-party contractor risk reduction — all external access is monitored and controlled
  • Monthly SOC reporting — structured evidence for governance, compliance, and continuous improvement
  • No need for a dedicated cybersecurity team — protection is continuous and automatic

For Production​

  • Zero disruption to manufacturing operations — protection is transparent to process control
  • Maintenance workflow integration — approved changes proceed normally; only unauthorised actions are blocked
  • Staff training included — plant personnel are trained to understand the dashboard and respond to alarms

The deployment demonstrates that site-wide active protection with real-time operational dashboards can be achieved in complex manufacturing environments without dedicated cybersecurity staff. The First Watch platform provides the control room with the same level of cyber awareness that it has for process alarms — continuous, visible, and actionable.

For more information or to discuss a deployment for your manufacturing facility, please contact us.