The Challenge
Sydney Metro required improved visibility and monitoring of their operational technology environments and key rail sub-systems. Existing tools provided limited insight into OT network traffic, leaving significant gaps in real-time threat detection and asset visibility across critical rail infrastructure — making it difficult to identify and respond to OT security incidents in a timely manner.
The Solution
L2iQ deployed Nozomi Networks sensors across key OT network segments, integrating the platform with Sydney Metro’s existing SIEM and SOC workflows. Tailored dashboards were delivered to surface relevant asset and security information, and knowledge transfer sessions embedded the capability with internal operational and cyber security teams. The deployment was designed to provide immediate operational value while integrating into existing CSOC processes.
What L2iQ Delivered
- Nozomi sensor deployment across key OT sub-system network segments capturing rail traffic
- Integration with existing SIEM and CSOC workflows for centralised alerting and incident response
- Tailored dashboards highlighting discovered assets, issues and security events
- Knowledge transfer sessions enabling internal stakeholders to interpret and act on Nozomi alerts
- Identification of misconfigurations and network improvement areas within weeks of deployment
- Remediation plans developed for identified issues, improving overall OT security posture
The Outcome
The project was delivered in line with project milestones and successfully integrated into CSOC operations, reducing time to detect and respond to OT incidents. Multiple misconfigurations and network improvement areas were identified within weeks of deployment. Collaboration between the CSOC, OT cyber security and operational engineering teams was strengthened through shared visibility, and remediation plans were developed for all identified issues.