Sample Security Audit — Meridian Fabrication Co.

1 · Executive Summary

Meridian is one compromised vendor remote session away from a production week lost. The plant's three CNC controllers run Windows 7 Embedded and Windows XP panels; the office network and the machine network share one switch and one broadcast domain; and the machine vendor's remote-support appliance bridges the internet to the same flat fabric on a permanent link. Accounting runs on a shared Windows workstation whose files live on a 9-year-old NAS with a failed drive in its RAID array (degraded, alarming for weeks, unheeded). Customer CAD/CAM files — some under defense-subcontractor NDAs — sit on that same NAS with folder permissions of "Everyone: Full Control." Two findings here are not "what if": the degraded RAID and the always-on vendor bridge are incidents-in-waiting already resident in the plant. This audit is also deliberately scoped: it touches office IT and the OT boundary; it does NOT certify machine safety systems, which are a separate engineering discipline.

2 · Assets & Crown Jewels

Asset	Data held	Impact if lost/public
CNC controllers ×3 (Win7 Embedded / XP panels)	Machine programs, uptime — the plant's revenue engine	EXISTENTIAL stopped machines = stopped revenue; corrupt program = scrap or injury
Customer CAD/CAM job library (NAS)	Proprietary & NDA-wrapped parts drawings, incl. defense-adjacent subcontracts	CRITICAL contract loss + NDA breach litigation
Accounting workstation + QuickBooks (NAS)	Bank details, payroll, customer/vendor records	HIGH payment fraud pivot; 9-year-old degraded NAS is a hardware clock
Vendor remote-support appliance (machine OEM)	Permanent inbound bridge to the plant flat network	HIGH supply-chain entry point (documented pattern in industrial incidents)
Office email (5 seats, Okta-less O365)	Quotes, POs, customer contacts	MEDIUM BEC pivot; MFA on ✓ (one thing that's right)

3 · Findings & Severity

#	Finding	Detail	Severity
F1	IT/OT flat network — one switch, one domain	Office malware can see CNC controllers directly. From the reception PC we enumerated all three controllers in under two minutes (consented test, off-shift).	CRITICAL
F2	CNC controllers run EOL Windows (7 Embedded / XP)	No patches since 2015–2019; no EDR supportable. OEM says replacement means machine downtime + recertification ≈ $40K/machine.	CRITICAL
F3	NAS RAID-5 degraded for weeks (one failed disk, alarm active)	Second disk failure now = total library loss. Also hosts the QuickBooks company file. This is a today-problem.	CRITICAL
F4	Vendor remote bridge permanently open, unmanaged credentials	OEM tech account password rotated never; appliance firmware 4 years stale; no logging of vendor sessions reaching IT or management.	HIGH
F5	CAD library permissions "Everyone: Full Control"	Any office login — including past interns' accounts still enabled — can read/exfiltrate every drawing.	HIGH
F6	14 stale AD/local accounts incl. 4 former employees	Two still had VPN-capable group membership from a legacy experiment.	HIGH
F7	Backups: robocopy to the same NAS	"Backup" of the library lives in the same blast radius as the library. No offline or off-site tier.	HIGH
F8	No network monitoring or syslog anywhere	Nothing would record an intruder touching a controller. Safety PLC interlocks are hardware (good), but data integrity on job files is unverified.	MEDIUM

4 · Threat Model — most probable attack paths

T1 · IT ransomware spills into OT

The classic: office phish → flat network (F1) → controllers encrypted (F2 can't be remediated/patched, only isolated) → production dark for a week+. Estimated loss ≈ $310K (quoted contracts + overtime catch-up).

T2 · Design-library exfiltration

Stale account (F6) or insider (F5) walks out with NDA drawings. Defense-adjacent customers audit; the contract evaporates. This sector treats IP loss as terminal.

T3 · Vendor bridge compromise

OEM's support account reused elsewhere (F4) → attacker rides the legitimate appliance inbound → straight onto controllers. Observed repeatedly in published industrial incident reports.

T4 · Silent drive failure

Not an attacker at all: F3's degraded RAID fails a second disk mid-run — the most likely "event" on this list, and already in progress.

Attack narrative · T1 mapped to MITRE ATT&CK (IT→OT)

TA0001 Initial Access — spearphishing with a fake "PO" attachment to quotes@ (T1566.001)
TA0007 Discovery — network share enumeration finds machine shares + CAD library (T1135) on the flat fabric
TA0008 Lateral Movement — SMB (T1021.002) from office → controllers (F1); EOL OS means commodity malware runs unopposed (F2)
TA0040 Impact — encryption (T1486) of office + OT shares; backups in the same blast radius (F7) cannot rescue it
Outcome — est. 5–10 production days dark; NDA customers notified where drawings were touched; the degraded NAS (F3) may not even survive the event forensics.

5 · Risk Matrix (likelihood × impact)

Impact →

LowModerateHighSevereExistential Likely

F5·F6

T4F3

Possible

T2T3

F1·F2

Unlikely

Rare

Overall 8.1/10 — the highest-severity sample in this set, driven by an unsegmented IT/OT boundary against end-of-life controllers plus an already-active hardware failure. OT risk lens aligns to IEC 62443 zones/conduits language; safety functions themselves were hardware-interlocked and out of cyber scope — stated candidly to keep the rating honest.

6 · Remediation Roadmap

Immediate (this week) — RAID rebuild + off-site copy ≈ $1,100 hardware + $40/mo

Hot-spare installed and rebuild verified; nightly encrypted library backup to cloud with 180-day retention + a weekly restore checksum. The "already in progress" incident gets closed first.

Week 1 — Segment IT from OT ≈ $1,600 firewall + labor

Dedicated industrial firewall/VLAN: controllers + engineering PCs in a zone that office machines cannot route to; only the engineering file-gateway bridges, and that two-way conduit is firewall-logged.

Week 1 — Vendor bridge governance $0

Appliance moved to always-blocked-unless-enabled; a "vendor access requested/authorized/logged" ticket ritual per session; stale firmware updated by the OEM as a contract deliverable.

Week 2 — Identity cleanup + drawings ACLs ≈ $640 labor

Stale accounts disabled (scripted report monthly); CAD library restricted to engineering group; DLP-light folder auditing on the drawings share.

Week 2–3 — Controller hardening without touching the machines ≈ $900

Since patching/replacement is off the table near-term: application allowlisting where supported, USB port control discipline, host firewall rules denying SMB from non-engineering hosts, and one-way job-file flow patterns documented per IEC 62443 zone guidance.

Week 3–4 — Monitoring + incident one-pager ≈ $720 + $12/mo

Syslog from firewall + servers to a lightweight collector; a laminated "machines down — who to call" card next to the shop phone; annual tabletop drill with the foreman.

7 · Residual Risk Statement

After Phases 1–2: projected 3.4/10 (LOW-MODERATE). The EOL controllers remain the irreducible core — segmentation and allowlisting compress the exposure until the OEM recertification window (capital budget, FY-next) allows replacement. Documented limitations: machine-safety interlocks are wired in hardware and were explicitly out of cyber scope; this audit makes no claims about functional safety. Re-score in 90 days and again at controller refresh.