My previous post was about securing OT and medical technology. For management, the underlying issue is legacy, and how to think about it.<\/p>\n
Legacy isn\u00b4t a failure. It is often a sign that something has worked for a long time. A control system that has run a plant for twenty years has paid for itself many times over. The problem is that its risk has grown while nobody looked.<\/p>\n
So how should management think about it?<\/p>\n
Make it visible. Every legacy system should have an owner, a known risk and a decision: replace, isolate or accept. Accepting is fine, as long as someone signs it.<\/p>\n
Price the risk, not just the replacement. Replacing a system is expensive and easy to postpone. But what does it cost if it stops for a week? Or if it is the way an attacker gets into the rest of the company?<\/p>\n
Budget for protection while you wait. If replacement is five years away, you need segmentation, monitoring and controlled access now. Those are much cheaper than the replacement.<\/p>\n
Include security in procurement. The systems you buy today are tomorrow\u00b4s legacy. Demand a support period, patching and security features from the start.<\/p>\n
And give OT and IT a common table. Too often they are separate worlds, and the attackers use the gap.<\/p>\n
Legacy is a debt. You can pay the interest, or you can pay it off. Ignoring it isn\u00b4t an option.<\/p>\n","protected":false},"excerpt":{"rendered":"
My previous post was about securing OT and medical technology. For management, the underlying issue is legacy, and how to think about it. Legacy isn\u00b4t a failure. It is often a sign that something has worked for a long time. A control system that has run a plant for twenty years has paid for itself […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,39,20],"class_list":["post-1420","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-legacy","tag-ot"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1420"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1420\/revisions"}],"predecessor-version":[{"id":1459,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1420\/revisions\/1459"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}