{"id":3017,"date":"2026-03-26T12:37:46","date_gmt":"2026-03-26T12:37:46","guid":{"rendered":"https:\/\/inprotech.es\/?p=3017"},"modified":"2026-03-26T12:37:46","modified_gmt":"2026-03-26T12:37:46","slug":"active-blocking-of-malicious-ips-with-inprotech-guardian","status":"publish","type":"post","link":"https:\/\/inprotech.es\/en\/active-blocking-of-malicious-ips-with-inprotech-guardian\/","title":{"rendered":"Active Blocking of Malicious IPs with InproTech Guardian"},"content":{"rendered":"

The threat landscape in OT cybersecurity environments is evolving at an increasing pace. Industrial digitalisation, IT\/OT convergence and the need for remote connectivity have significantly expanded the exposure surface of critical infrastructures.<\/span><\/p>\n

Traditionally, OT networks were designed under principles of strict isolation and segmentation. However, integration with corporate networks, external services, remote suppliers and maintenance platforms has progressively reduced that isolation, broadening the attack vector available to malicious actors.<\/span><\/p>\n

This new scenario poses a significant technical challenge: maintaining the availability, operational continuity and stability requirements inherent to industrial environments, whilst incorporating defence mechanisms capable of responding to increasingly automated and distributed threats.<\/span><\/p>\n

Traditional monitoring solutions, based exclusively on detection and alerting, prove insufficient against attacks that can escalate within seconds. The ability to automatically contain a threat before it impacts industrial processes becomes a critical requirement.<\/span><\/p>\n

In this context, <\/span>InprOTech Guardian<\/b> introduces a new Active Blocking capability, designed to detect potentially malicious connectivity and execute immediate containment actions through direct integration with firewall infrastructures from multiple vendors.<\/span><\/p>\n

This article details the architecture, operation and technical integration of this capability, as well as its application in OT environments that demand high standards of availability and control.<\/span><\/p>\n\n

 <\/p>\n

Problem Context<\/b><\/h2>\n

Controlled exposure of OT services to external networks:<\/b><\/h3>\n

The evolution of OT environments has made it necessary to expose certain services in a controlled manner towards external networks or the Internet. VPN access, remote administration services, industrial web portals or third-party integrations require publishing entry points protected by perimeter firewalls.<\/span><\/p>\n

Although these openings are implemented under segmentation and control criteria, their mere existence introduces a constant flow of unsolicited traffic originating from external public IP addresses.<\/span><\/p>\n

In practice, any service accessible from the Internet becomes a target for:<\/span><\/p>\n