Scope
Location
Midwest
Client
Midstream Transmission Company
BACKGROUND AND CHALLENGE
Operational Technology (OT) facilities play a critical role in maintaining pipeline operations, system visibility, and continuity. While operators often focus on cybersecurity, network architecture, and process resilience, physical security remains an essential component of overall OT protection. Weak physical controls can undermine otherwise effective safeguards, creating vulnerabilities that affect system availability, recovery performance, employee safety, and operational resilience. This is particularly important for remote, distributed, and disaster recovery (DR) facilities, where physical and infrastructure weaknesses may not be identified through traditional cybersecurity or facility reviews, yet can have significant operational consequences during disruptions.
A long-standing client engaged LSC through a competitive RFP process to perform a physical security review of a redundant/backup pipeline OT facility supporting critical operational systems. In addition to LSC’s established relationship with the operator, the team brought the required safety qualifications, security training, and site access certifications necessary to work safely within a regulated pipeline environment. The review evaluated access controls, environmental protections, and monitoring capabilities at a facility that served a DR role but remained dependent on the primary environment for certain critical functions. Findings revealed vulnerabilities that increased the risk of unauthorized access, preventable physical damage, and infrastructure dependencies, creating potential impacts on physical security, OT cybersecurity, operational continuity, recovery readiness, and personnel safety.
Our Approach
Physical security was evaluated in the context of pipeline operations—how systems are built, maintained, and relied upon during disruption events. The review focused on site access controls and physical separation, exposure of critical OT systems, monitoring and alerting capabilities, and environmental disruption pathways. Findings were prioritized based on their potential to disrupt operations, impact personnel safety, or degrade recovery performance. This risk-based prioritization enabled the client to focus resources on the vulnerabilities that presented the greatest operational, cybersecurity, safety, and continuity risk rather than treating all findings equally.
Key Conditions Identified
- Shared building occupancy increased the risk of unauthorized or unintended access from adjacent tenants, creating additional challenges for controlling physical access to critical systems.
- Limited perimeter protection with no fencing or defined site boundary, reducing the facility’s ability to deter, detect, or control unauthorized entry.
- The exterior door was found to open easily without a key, allowing unauthorized access and increasing safety risks for personnel entering the facility.
- Weak separation between general-use areas and critical OT systems increases the likelihood that unauthorized personnel could access systems supporting operations.
- No internal cameras or monitoring within the OT room or secured areas, allowing unauthorized activity or environmental issues to go undetected and delaying response or investigation.
- Direct environmental disruption pathways (e.g., water intrusion) existed that could damage critical equipment, increasing the risk of unplanned outages and costly repairs.
- Critical OT systems were housed in areas vulnerable to preventable physical damage, creating the potential for operational disruption and extended recovery efforts.
- The DR site retained dependencies on the primary environment, including the lack of an independent secondary internet connection, reducing resilience during primary-site disruptions.
Operational Perspective Matters
LSC evaluates physical security through the lens of operational resilience. Drawing on experience across OT cybersecurity, industrial control systems, pipeline engineering, integrity management, corrosion control, and operational risk management, LSC evaluates physical security in the broader context of how critical infrastructure is designed, operated, maintained, and recovered during disruption events.
This experience enables LSC to develop recommendations that are practical, prioritized, and aligned with real-world operating conditions.
Solutions Implemented, Impact, and Client Value
Targeted improvements were implemented to address key failure pathways and strengthen both physical security and recovery capability. These included strengthening internal access controls, deploying internal IP cameras for monitoring and alerting, improving exterior door access procedures, evaluating perimeter protection, improving internal separation, addressing environmental vulnerabilities, and establishing a secondary internet connection. These improvements reduced the likelihood that localized issues would escalate into broader operational or safety impacts, including unsafe conditions for personnel, disruptions to operational oversight systems, equipment damage requiring emergency repairs, and service impacts beyond the facility. This approach enabled the organization to identify high-impact vulnerabilities, prioritize practical improvements, and strengthen continuity and recovery readiness. The result was a reduction in operational, safety, cybersecurity, and public risk exposure.
Results
The review helped the client translate physical security findings into meaningful improvements that strengthened OT resilience, recovery readiness, and overall risk management. It strengthened physical access controls by installing a strike plate to prevent manipulation of a critical access point, thereby reducing opportunities for unauthorized entry and facility tampering. Monitoring capabilities evolved from limited visibility to continuous 24/7 oversight, improving the organization’s ability to detect, investigate, and respond to potential security events affecting critical OT assets. Video recordings were securely retained off-site, strengthening incident-investigation capabilities and ensuring that evidence remained available during disruptions. The review also identified infrastructure dependencies that could affect disaster recovery performance, enabling targeted resiliency improvements and reducing common-mode failure risks. As a result, physical security findings were translated into a prioritized improvement roadmap aligned with operational continuity, recovery readiness, personnel safety, and cybersecurity objectives, while improving the organization’s understanding of how physical vulnerabilities can affect critical OT systems, recovery capabilities, and overall cybersecurity posture.
More importantly, the review helped the client view physical security as an essential component of OT cybersecurity and operational resilience rather than a standalone facility concern. By connecting physical vulnerabilities to recovery readiness, operational continuity, personnel safety, and cybersecurity risk, LSC provided the context needed to prioritize investments, align improvement efforts with business objectives, and strengthen the organization’s broader OT security strategy. The result was not just a more secure facility but a clearer roadmap for reducing risk and improving resilience across the OT environment.