How to think about legacy
Mar 27th, 2024 by Jesper Kråkhede
My previous post was about securing OT and medical technology. For management, the underlying issue is legacy, and how to think about it.
Legacy isn´t a failure. It is often a sign that something has worked for a long time. A control system that has run a plant for twenty years has paid for itself many times over. The problem is that its risk has grown while nobody looked.
So how should management think about it?
Make it visible. Every legacy system should have an owner, a known risk and a decision: replace, isolate or accept. Accepting is fine, as long as someone signs it.
Price the risk, not just the replacement. Replacing a system is expensive and easy to postpone. But what does it cost if it stops for a week? Or if it is the way an attacker gets into the rest of the company?
Budget for protection while you wait. If replacement is five years away, you need segmentation, monitoring and controlled access now. Those are much cheaper than the replacement.
Include security in procurement. The systems you buy today are tomorrow´s legacy. Demand a support period, patching and security features from the start.
And give OT and IT a common table. Too often they are separate worlds, and the attackers use the gap.
Legacy is a debt. You can pay the interest, or you can pay it off. Ignoring it isn´t an option.