Pragmatism in OT SOC: How System Monitoring Works in Practice

Klaus Mochalski and ⁠Ali Yekta⁠ (Yekta IT) discuss the enormous practical challenges involved in setting up a Security Operations Center (SOC) for OT. Learn why traditional IT responses - such as blindly isolating systems in industrial facilities -are extremely dangerous, why infected USB drives will still pose a real problem even in 2026, and how operators can gradually build an effective OT monitoring system through a smart combination of log data, network sensors, and trained playbooks.

Duration:

24 min

Guest in this episode:

Ali Recai Yekta

CTO - Yekta IT

Summary

‍

Sound Bites

Ali Yekta: “In IT, I can isolate the machine, that’s not such a big deal. [...] But at the power plant, for example, I don’t even have the technical means to shut down or isolate a particular unit or anything like that.”

Ali Yekta: [I had a situation] where someone connected a USB drive to the HMI, and as a result, malware appeared on the HMI [...] and the customer said, ‘Well, that could take several weeks or even months, and until then we’ll just have to keep the HMI running because we can’t get a replacement on short notice.’”

Ali: “Sometimes the manufacturer says, ‘I recognize 300 protocols,’ and ‘300 protocols’ simply means, ‘I know that’s running there,’ but I don’t get any information. IEC 104 mode and other data, when it comes to payloads and function calls, I just don’t get anything.”

Ali Yekta: “But it turned out later that it was just the backup job downloading the signatures for the sensors [...] And if, at that moment, you act incorrectly, for example, if you say, ‘Okay, there’s a fire; we have to shut everything down right now’ just because that’s what the plan says, [...] then you’ll cause a great deal of damage [...].”

Ali Yekta: “First, I’d try to onboard as few systems as possible and write only a handful of use cases for them. It’s simply about getting a sense of what log data I have, what assets I have, and what I could detect with them, and then start with playbooks.”