Case Study: SOC Convergence for Airport OT Environments
International Airport Operations in the Middle East (GCC)
Real-time OT event forwarding without inbound risk
Preserving log integrity for SIEM correlation
Integrating OT telemetry into SOC workflows
Need / Problem / Context
Secure & rich OT Event Forwarding to a Centralized Cisco Plunk SIEM
A major international airport needed to provide its centralized Security Operations Center (SOC) with real-time visibility into cybersecurity events occurring within the airport OT environment.
Operational alarms, security logs, and system events generated by industrial assets — including baggage handling systems, access control, airfield lighting, and SCADA platforms — needed to be ingested into the organization’s Cisco Splunk SIEM to enable centralized monitoring, correlation, and threat detection. However, the OT network controlling airport operations had to remain strictly isolated from external connectivity to prevent any remote cyber intrusion that could disrupt operations or compromise safety.
The challenge was therefore to securely transmit security telemetry and event data from airport OT systems to Cisco Splunk, while maintaining a strict one-way security boundary and preserving the integrity of the industrial control environment.
Solution Deployed
A Cyberium unidirectional gateway architecture was deployed between the airport OT network and the SOC to securely forward security events while maintaining strict physical separation. It enables reliable OT security telemetry transfer for centralized monitoring and threat detection — without exposing airport systems to inbound cyber risks.
2x OWA 3U pack @ 1 Gbps
Two unidirectional gateways were deployed to securely forward OT security events while preserving strict physical separation between airport operations and the central SOC.
High-Availability℗ Setup
Cyberium patented High Availability mechanisms ensure uninterrupted event forwarding and eliminate any single point of failure for this critical security monitoring flow.
Standard (SFTP)
+ HTTP/S API Connectors
Security events and operational logs are exported through standard secure protocols, enabling seamless integration with the centralized SOC and SIEM environment.
Splunk Configuration Deployment
Splunk ingestion pipelines and field mappings were configured to ensure airport OT events are fully interpretable and actionable within the centralized SIEM platform.
Outcomes & benefits
By extending SOC visibility to airport OT environments, the organization improved incident detection speed, reduced potential operational disruptions, and increased the value of its existing cybersecurity monitoring infrastructure.
Faster threat detection by providing the SOC with real-time visibility into airport OT security events
Reduced average operational outage time through earlier incident identification and response
Maximized return on investment of the existing SOC and SIEM infrastructure by extending its visibility to airport OT assets
Secure integration of remote operational environments into centralized cybersecurity monitoring
More use cases
- Critical OT & Industry 4.0
- OWA 2U/3U
- Custom SCADA, Siemens WinCC
- SQL Databases Agent
- Critical OT & Industry 4.0
- OWA 2U/3U
- Custom SCADA
- OPC UA Agent
- Critical OT & Industry 4.0
- OWA 2U/3U
- Cisco Splunk
- HTTP/S API, Syslog
- Critical OT & Industry 4.0
- OWA 2U/3U
- Custom SCADA
- SQL Databases Agent
- Critical OT & Industry 4.0
- OWA 2U/3U
- Hexagon PAS
- File Transfer Agent, SMTP
- Critical OT & Industry 4.0
- OWA 2U/3U
- GE OSM (On-Site Manager)
- File Transfer Agent, SFTP, FTP/S/ES
We secure the Critical
— connecting what should stay isolated.
Latest blog entries
- AI & Cybersecurity, Threat Landscape
Most cyberattacks on industrial infrastructure don’t start in the plant. They start in the office. A phishing email reaches an (…)
- AI & Cybersecurity, Threat Landscape
In 2025, the baseline assumption of industrial cybersecurity broke. For twenty years, defenders had one reliable edge over attackers: time. (…)
- OT Cybersecurity Best Practices, Threat Landscape
Every documented OT breach in the past five years started at the same place: an internet-facing asset that operators believed (…)
- OT Cybersecurity Best Practices, Regulations & Compliance, Threat Landscape
In every major OT cyberattack of the past decade, firewalls were present. In each case, they failed. Not because they (…)
- Architecture Design Patterns, Engineering Insights
Industrial cybersecurity starts with a simple reality: you cannot detect threats if you cannot see what happens inside your OT (…)
