Separating owner, EPC contractor and subcontractor networks on a construction site

We have built segregated site networks for the owner, the EPC contractor and other site users on five wind farm construction sites on Egypt’s Gulf of Suez. They range from Ras Ghareb Wind Energy in 2017 to Suez Wind Energy in 2025. The same thinking carries into the permanent substation network, where information technology (IT) and operational technology (OT) also need to be kept apart.

Segmentation and segregation are two parts of one design

The Australian Signals Directorate (ASD), Australia’s national cybersecurity agency, distinguishes the two terms. Segmentation divides a network into smaller networks. Segregation is the set of rules that controls which hosts and services may communicate between them [1]. ASD also warns that a flat network, treated as trusted throughout, gives an intruder wide access after a single breach [1].

On a construction site, virtual LANs (VLANs) and subnets create the segments, and the firewall enforces the segregation. Contracts and specifications often say “segregated networks” for both together, and our project records use the term the same way.

Why each party needs its own segment

Five groups share a construction site network, and their interests differ.

• Party

  Owner and owner’s engineer

  Why it needs its own segment

  Holds commercial, lender and design-review documents, and keeps its network after construction ends

• Party

  EPC contractor

  Why it needs its own segment

  Runs site management, document control and links to its head office, under its own security policies

• Party

  Subcontractors and other third parties

  Why it needs its own segment

  Many companies on short stays, with laptops nobody on site has checked; they need the internet and little else

• Party

  Visitors

  Why it needs its own segment

  Need short, logged access to the internet only

• Party

  Equipment makers (OEMs)

  Why it needs its own segment

  Need remote access for commissioning and support, limited to named systems

Separation also protects capacity. Without limits, camp and visitor use can fill the backhaul link that the site office needs for drawings and calls. It also gives the owner’s engineer a design that can be reviewed party by party.

A reference design for the construction site

This is the design we recommend for temporary site facilities (TSF), the offices, camps and stores set up for construction. Our standard design gives the owner, the EPC contractor, third parties and visitors separate segments, each with its own wireless network and bandwidth limit, and puts visitors behind a captive portal. We recommend adding the remote access and management segments shown below. We plan the site network during the site survey with a predictive Wi-Fi design and an on-site Wi-Fi survey, then issue the access point layout to the EPC contractor for cabling.

• Segment

  Owner

  Users

  Owner staff and owner’s engineer

  Wireless network

  Its own

  Bandwidth

  Its own limit

  May reach

  Internet; owner systems

• Segment

  EPC contractor

  Users

  Contractor staff

  Wireless network

  Its own

  Bandwidth

  Its own limit

  May reach

  Internet; contractor systems

• Segment

  Third parties

  Users

  Subcontractor staff

  Wireless network

  Its own

  Bandwidth

  Its own limit

  May reach

  Internet only

• Segment

  Visitors

  Users

  Guests

  Wireless network

  Its own, behind a captive portal

  Bandwidth

  Its own limit

  May reach

  Internet only, for a set period

• Segment

  Remote access

  Users

  OEM and vendor engineers

  Wireless network

  None; virtual private network (VPN)

  Bandwidth

  Per session

  May reach

  Named systems only, with logging

• Segment

  Management

  Users

  Network administrators

  Wireless network

  None

  Bandwidth

  Reserved

  May reach

  Switches, access points and firewalls

Bandwidth limits are agreed with the client before go-live. We recommend five principles for the firewall rules:

1. Block traffic between segments by default.
2. Give each segment its own route to the internet, with its own policy and bandwidth limit.
3. Open a flow between two segments only when both parties request it in writing, and record it.
4. End remote access in its own segment, with named accounts and logging. Under our security baseline, logs are kept for 90 days.
5. Manage devices only from the management segment, and change every default credential before go-live.

On Infinity Power’s 200 MW site at Ras Ghareb, working for PowerChina, the EPC contractor, we delivered separate segments for the contractor, the owner and guests. The scope also covered VPN access, managed power-over-Ethernet switches and indoor access points. Survey to go-live took 7 weeks. On Suez Wind Energy, the segregation covered construction zones across the north and south sites. Our Site Mobilization service includes segregated site networks as standard.

IT and OT separation at the substation

The permanent network at the substation carries two kinds of traffic. Operational technology (OT) covers the supervisory control and data acquisition (SCADA) system and the control equipment that runs the plant. IT covers the office network, IP telephony, video conferencing and staff Wi-Fi. The SCADA system is typically part of the turbine maker’s or grid vendor’s scope, while the office network belongs to the owner.

ISA/IEC 62443-3-2, the part of the industrial cybersecurity standard that deals with risk assessment and system design, sets out the method. The system under consideration is partitioned into zones and conduits, the risk of each zone and conduit is assessed and each receives a target security level [2]. A conduit groups the communication channels between zones that share the same security requirements [2].

A substation diagram drawn this way shows:

• an OT zone for the SCADA servers and control systems, inside the supplier’s boundary;
• an IT zone for the office network, telephony, video conferencing and Wi-Fi;
• a remote access zone where vendor VPN sessions end, between the outside world and the OT zone;
• conduits enforced by firewalls, each with a written list of allowed flows.

Our part is the ICT the SCADA system depends on: networks, connectivity, access and IT support. The SCADA system itself stays with its supplier. The permanent network is covered by our Plant Communications service. For owners, our ICT Advisory service covers oversight of the EPC contractor’s ICT.

Checklist before mobilization

1. 1List every party that will use the site network, including visitors and remote vendors.
2. 2Give each party its own segment, wireless network and bandwidth limit.
3. 3Put visitors behind a captive portal with time-limited access.
4. 4Keep a separate management segment for network devices.
5. 5Block traffic between segments by default, and record every exception.
6. 6Route vendor remote access through a VPN to named systems, with logging.
7. 7Change all default credentials before go-live.
8. 8Record every segment in the IP and VLAN inventory and the port matrix for handover.
9. 9Plan the permanent substation network as zones and conduits, with IT and OT separated.
10. 10Have the owner’s engineer review the design before cabling starts.