📋 Case Study

Ventilation DCS Cyber Isolation – Underground Gold Mine, Ontario

Direct Ethernet connectivity between DCS and corporate IT network; no segmentation or protocol whitelisting

🏗️ Project Overview

Modernization of 30-year-old ventilation control system serving 12 km of development drives

🎯 Challenge

Direct Ethernet connectivity between DCS and corporate IT network; no segmentation or protocol whitelisting

🔧 Design Approach

Deployment of unidirectional data diode + OPC UA Pub/Sub gateway with role-based access control and encrypted telemetry forwarding

📐 Design Diagram

AI-generated project design illustration

📐 Key Calculations

Data Diode Throughput Margin

(Rated Throughput − Max Observed Flow) / Rated Throughput × 100

Result: 68%

Guarantees deterministic flow under peak load

OPC UA Message Latency

End-to-end message round-trip time

Result: ≤127 ms

Meets SIL-2 timing requirements for emergency shutdown coordination

📊 Results

Eliminated all remote code execution vectors; reduced false alarm rate by 74% due to clean telemetry streams

💡 Lessons Learned

• •Unidirectional diodes require protocol-aware gateways—not just packet filters
• •OPC UA Pub/Sub must be hardened with X.509 certificate pinning

✅ Key Takeaways

• 1Unidirectional diodes require protocol-aware gateways—not just packet filters
• 2OPC UA Pub/Sub must be hardened with X.509 certificate pinning