Build certificate trust into OT access.
Certificate services for OT wireless authentication, internal service communications and network management access.
Greater Western WaterThe constraint
Greater Western Water’s OT wireless programme needed certificates for device authentication, alongside trusted communications between servers and access to network management consoles. The design had to protect the root of trust and keep issuing and validation services available across the supporting environment.
Our design work
Quokka’s specialist PKI design work for Greater Western Water supported certificate-based authentication in the OT and SCADA environment. The scope connected wireless device identity with the certificate services needed for issuance, renewal and validation.
Certificate issuance
During authentication
The design
Start with the authentication use cases
Work through device certificates for wireless access, certificates for internal servers and network consoles, and validation requirements. Align the PKI scope with the wider Cisco ISE and wireless-controller programme.
Separate root trust from certificate issuance
Design a two-tier Microsoft Active Directory Certificate Services hierarchy. Keep the root authority offline and use two issuing authorities for the day-to-day certificate service.
Design the validation path
Provide paired web services for certificate-chain information and revocation checking. Account for the primary and secondary data centres and load-balanced access to those supporting services.
The design output
The design brought device identity, certificate issuance and validation into one architecture for the OT environment. It defined the trust hierarchy and supporting service flows needed by the broader wireless authentication programme.
Specialist PKI design by Quokka Advisory’s Noel Kelly through Data#3 for Greater Western Water, supporting the wider Cisco ISE and wireless-controller programme.
The engineering decisions.
The PKI design separates the root of trust, day-to-day certificate issuance and the status checks used during authentication.
Protect the root while keeping issuance available
The two-tier Microsoft AD CS design keeps the standalone root authority offline except for controlled maintenance of the issuing authorities. Two enterprise issuing CAs provide the day-to-day certificate service. This separates the root of trust from the systems processing routine device and service requests.
Define who can request and renew each certificate
Certificate templates held in the directory define the permitted uses and requesters. Either issuing CA can process issuance or renewal when it has the appropriate template and the requester has permission. The design links the certificate lifecycle to the device, server and management-console use cases identified in workshops.
Keep validation information reachable
Two supporting web servers provide authority information, certificate revocation lists and online certificate-status checking. Load-balanced access across the primary and secondary data centres supports those services. Authentication relies on the certificate chain and status information; it does not require the offline root to participate in each connection.
Support the wider OT authentication programme
The specialist scope connects wireless device certificates, server-to-server communications and network management access to the PKI services they require. It supports the broader Cisco ISE and wireless-controller programme, with certificate issuance, renewal and validation defined as distinct parts of the architecture.
More of our work
All project storiesGive support teams a controlled path into OT.
Remote access for internal teams and vendors supporting operational systems.
Urban UtilitiesDesign the network around the pipeline.
OT architecture for the six-site Tarong Pipeline, covering communications, segmentation and dedicated operational support.
SunwaterWhat needs to work better?
Talk to us about the environment, the constraint and the change.