Securing OT: Old technology, strict rules
Mar 13th, 2024 by Jesper Kråkhede
Operational technology, the systems that run factories, power grids and water plants, and medical technology in hospitals, is one of the hardest areas in security. Not because it is exotic, but because it is old and heavily regulated.
A control system or a medical device is often certified as a whole. Changing the operating system, installing a patch or adding an antivirus can void the certification. So systems run Windows versions that went out of support years ago, and they will keep doing so for many years more.
How should you handle it architecturally? Here is my approach.
Inventory first. You can´t protect what you don´t know. Use passive monitoring that listens to the network and identifies devices and protocols without disturbing them. Defender for IoT and similar tools do this well.
Zones and conduits. Divide the environment into zones by function and risk, in line with IEC 62443, and control every connection between them. The Purdue model is still a good starting point.
A real boundary between IT and OT. A DMZ in between, with no direct connections. Data that needs to go out goes through brokers or, for the most critical systems, a data diode.
Separate identities. OT should not depend on the corporate Active Directory. If the IT domain is encrypted, the plant must still run.
Controlled remote access. Vendors need access, but through a controlled path: a jump host reached from a PAW, with approval, time limits and logging. Never a remote access tool installed directly on a control system.
Monitor what you can´t patch. Unusual commands, new devices or connections to the internet should raise alarms.
And plan for the day it goes down: manual operation and backups of configurations and programs.
You can´t make old technology new. You can put a strong fence around it.