How do I check that our office network cannot reach production controllers?

Test it, then watch it. For the test, take an ordinary office laptop and, with the OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. engineer's agreement, try to open a connection to a controller's address and port and to the HMI and SCADA servers; use a simple connection test, never a scanner, against production devices. Review the firewall rules between office and production for broad rules and for old exceptions nobody can explain. Then watch real traffic for a few weeks, because the routes that matter are often the forgotten ones: a PC with one network card in each network, a supplier's VPN that ends inside production, a wireless bridge. From the Pro plan, NetSenX flags traffic that crosses levels of the plant network, such as an office host reaching a controller, so a path that should not exist shows up the first time it is used. A path that exists but is never used stays invisible to any passive sensor.

← All 50 questions on OT and IoTAll topics