Field-ready guides, playbooks, and architecture maps for OT operators

Operational Technology (OT) encompasses the hardware and software that monitor or control physical processes—from hospital chillers and ammonia refrigeration compressors to municipal water pumps and manufacturing assembly lines. Unlike enterprise IT, where confidentiality comes first, OT is governed by Safety, Reliability, and Availability.

Why Standard IT Security Fails in OT

• Active Scanning Crashes Legacy Controllers: Standard IT vulnerability scanners send malformed packets that can freeze programmable logic controllers (PLCs) or trip safety interlocks.
• 20-Year Equipment Lifecycles: Industrial controllers run continuously for decades on proprietary protocols (Modbus, BACnet, DNP3, EtherNet/IP) without native encryption or modern authentication.
• Maintenance Windows Are Rare: A hospital HVAC plant or continuous food line cannot reboot every "Patch Tuesday." Compensating network controls must protect unpatched assets.

The Five Non-Negotiable Starting Controls (SANS / CISA Baseline)

• 1. OT-Specific Incident Response Plan: Document manual override procedures and out-of-band communication trees before an outage hits.
• 2. Defensible IT/OT Architecture: Eliminate flat networks; enforce an Industrial DMZ between corporate email/ERP and plant controls.
• 3. Passive OT Network Visibility: Continuously inventory assets and east-west protocol flows using non-intrusive SPAN/TAP sensors.
• 4. Secure Remote Access: Replace shared vendor VPNs and cellular modems with MFA-enforced, time-bound, session-recorded gateways.
• 5. Risk-Based Vulnerability Management: Prioritize patching only on boundary gateways and internet-exposed jump hosts; isolate internal field devices.

Supervisory Control and Data Acquisition (SCADA) servers, Human-Machine Interfaces (HMIs), and Engineering Workstations (EWS) sit at the nerve center of industrial and utility operations. Hardening these Windows/Linux hosts and control pathways dramatically shrinks your blast radius without touching live PLC logic.

10-Point SCADA & EWS Hardening Baseline

• Eliminate Direct Internet Exposure: Audit external IPs (via Shodan/Censys) and remove any port-forwarded RDP, VNC, HTTP, or Modbus TCP interfaces.
• Decouple Active Directory: Never join SCADA servers or HMIs to the corporate IT Active Directory domain; use dedicated OT identity stores to prevent IT ransomware domain takeover.
• Lock Down Engineering Workstations (EWS): Keep EWS laptops off corporate Wi-Fi and email; enforce application allowlisting and disable unauthorized USB mass storage.
• Remove Default & Shared Vendor Accounts: Change factory PLC/HMI passwords and eliminate shared "operator" or "integrator" logins.
• Enforce Role-Based Access Control (RBAC): Separate "view-only" operator consoles from engineering accounts permitted to download ladder logic or modify setpoints.
• Disable Unused OS Services & Legacy Protocols: Turn off SMBv1, PowerShell remoting where unneeded, Telnet, and FTP on Windows/Linux SCADA hosts.
• Filter Industrial Protocols at Zone Boundaries: Use OT-aware firewalls to restrict Modbus, DNP3, and IEC 61850 function codes (e.g., allow read-only polling from historians, block unauthorized write commands).
• Protect Historian Replication: Place historians in the Industrial DMZ and pull data from OT rather than allowing IT users to query Level 2/3 servers directly.
• Maintain Offline, Tested Golden Backups: Store offline copies of PLC project files, HMI screens, and SCADA configurations—and test restoration drills semi-annually.
• Enable Centralized OT Logging: Forward authentication events, firewall denials, and PLC configuration change alerts to a dedicated OT log collector.

When ransomware hits corporate IT or anomalous commands appear on a control network, pulling the wrong network cable can blind operators or cause physical equipment damage. This four-phase playbook aligns IT responders with plant and facility operators.

Phase 1: Immediate Triage & Life-Safety Check (Minutes 0–15)

• Verify Physical Safety First: Confirm with control room operators whether physical processes (pressures, temperatures, chemical dosing, medical gas, refrigeration) remain stable.
• Switch to Local / Manual Control if Needed: Prepare operators to transition critical loops to local manual operation before isolating upstream SCADA links.
• Activate Out-of-Band Comms: Move incident coordination off corporate email/Teams onto pre-designated cell/SMS bridges or printed call trees.

Phase 2: Controlled Containment—Not Blind Shutdown (Minutes 15–60)

• Sever the IT/OT Bridge at the DMZ: Block traffic at the Level 3.5 Industrial DMZ firewall first to stop IT-borne ransomware from reaching SCADA/HMIs—while preserving local plant-floor visibility.
• Revoke Third-Party Remote Access: Disable vendor VPN tunnels, jump-host sessions, and external cellular gateways until access paths are verified clean.
• Preserve Volatile Evidence: Do not power-cycle compromised HMIs or engineering workstations; capture memory/logs and disconnect network patch cables only under joint IT/OT approval.

Phase 3 & 4: Eradication, Safe Recovery & Post-Incident Review

• Validate PLC Logic & Firmware Integrity: Compare running PLC programs and setpoints against known-good offline golden backups before returning to automated control.
• Staged Reconnection: Re-enable telemetry and enterprise reporting only after forensic clearance and hardened conduit verification.

Flat networks are the #1 reason an email phishing click in accounting shuts down a manufacturing line or building chiller plant. Effective segmentation groups assets with similar safety and criticality requirements into Zones and controls traffic between them through inspected Conduits (ISA/IEC 62443).

Field-Tested Tips & Common Pitfalls to Avoid

• Tip 1 — Hunt Down "Dual-Homed" PCs: Operators frequently install a second NIC or USB-to-Ethernet adapter on an HMI so they can check email and view PLCs from one desk. Every dual-homed machine silently bypasses your firewall.
• Tip 2 — Start at the Highest-Risk Boundary (Level 3.5): Don't try to micro-segment every PLC on day one. First build a true Industrial DMZ between corporate IT (Level 4) and site operations (Level 3) so zero traffic crosses directly.
• Tip 3 — Use "Monitor-Only" Firewall Policies Before Enforcing Deny-All: Log allowed flows for 2–4 weeks across full production/shift cycles so you don't accidentally block a monthly batch recipe upload or chiller failover heartbeat.
• Tip 4 — Isolate Building Automation (BAS) from Tenant & Clinical Wi-Fi: HVAC, lighting, and elevator controllers belong on dedicated OT VLANs—never sharing subnets with guest Wi-Fi, badge readers, or VoIP phones.
• Tip 5 — Consider Unidirectional Gateways (Data Diodes) for Outbound Telemetry: Where corporate analytics or cloud dashboards only need to read historian data, hardware-enforced one-way paths eliminate inbound attack vectors completely.
• Tip 6 — Inventory Shadow Cellular Modems: OEM equipment vendors routinely ship skids, boilers, and compressors with built-in 4G/5G cellular routers for remote diagnostics. Audit and bring them behind your DMZ jump host.

In 2026, operational technology has moved from an isolated engineering concern to a primary boardroom and cyber-insurance priority. Mid-market operators face a converging wave of IT/OT connectivity, third-party vendor exposure, and stricter regulatory enforcement.

Five Defining Shifts Shaping OT Security in 2026

• 1. Ransomware Targets Physical Uptime Over Data Theft: Threat actors increasingly target manufacturing, cold-storage food plants, hospitals, and municipal utilities because operational downtime creates immediate pressure to pay—even when no sensitive PII is stolen.
• 2. Third-Party Contractor & OEM Access Is the Top Entry Vector: Attackers exploit compromised HVAC, refrigeration, medical-device, and controls-integrator credentials to pivot directly into customer facilities.
• 3. AI-Accelerated Reconnaissance vs. AI-Assisted Anomaly Detection: Automated internet scanning identifies exposed BACnet, Modbus, and HMI portals within minutes of deployment, while defenders increasingly rely on passive behavioral baselining to catch unauthorized protocol commands.
• 4. CISO & Board Governance Takes Ownership of Cyber-Physical Risk: Organizations are consolidating fragmented IT and OT oversight under unified risk reporting, requiring clear, auditable metrics rather than ad-hoc plant exceptions.
• 5. Cyber Insurers Require Provable OT Controls: Underwriters now routinely ask for proof of IT/OT segmentation, MFA on vendor remote access, and offline control backups before binding or renewing industrial policies.

Municipal water and wastewater utilities operate geographically distributed assets—intake pumps, chemical dosing skids, lift stations, and elevated tanks—often managed by lean teams on tight municipal budgets.

High-Impact Protections for Water & Wastewater Operators

• Lock Down Remote Lift Station & Booster Telemetry: Replace unencrypted radio/cellular links and default PLC credentials with private APNs, encrypted VPN tunnels, and strict IP allowlisting.
• Protect Chemical Dosing & Treatment Setpoints: Implement hardware upper/lower limit interlocks and alert immediately on unauthorized PLC logic writes or out-of-hours HMI logins.
• Maintain Manual Fallback Readiness: Ensure operators can run treatment processes and pump stations locally in manual mode if SCADA visibility is temporarily lost.
• Align with AWIA Section 2013 & EPA Guidance: Integrate cyber risk scenarios into your America's Water Infrastructure Act (AWIA) Risk & Resilience Assessments and Emergency Response Plans.

From bulk electric substations to hospital microgrids, backup generation, and battery energy storage systems (BESS), power infrastructure demands deterministic reliability and strict perimeter defense.

Core Pillars of Grid & Critical Power Security

• Electronic Security Perimeters (ESP): Define clear, documented boundaries around all Cyber Assets supporting generation, substation automation (IEC 61850 / DNP3), and protective relaying.
• Interactive Remote Access Controls: Route all vendor and engineer remote maintenance through multi-factor authenticated intermediate systems with full session monitoring and encryption.
• Substation Physical & Serial Port Security: Lock unmanned substation cabinets, disable unused serial/Ethernet ports on RTUs and IEDs, and monitor physical cabinet tamper alarms alongside network telemetry.
• NERC CIP & NIST CSF 2.0 Mapping: Align low-, medium-, and high-impact distributed energy resources (DER) with NERC CIP standards and CISA cross-sector baselines.

Use this checklist before granting any HVAC, refrigeration, medical-device, or controls vendor remote connectivity into your building or plant.

• 1. Inventory Every Vendor Connection: List all active VPNs, TeamViewer/AnyDesk agents, jump hosts, and vendor-installed cellular modems.
• 2. Eliminate Always-On Tunnels: Require vendor connections to remain disabled by default and enabled only during scheduled service tickets.
• 3. Enforce Individual Named Accounts: Prohibit shared vendor logins (e.g., hvac_tech); require individual user identities.
• 4. Mandate Phishing-Resistant MFA: Require multi-factor authentication at the Industrial DMZ gateway before any internal OT asset is reachable.
• 5. Terminate Sessions in the DMZ: Never allow a vendor VPN to drop directly onto a PLC, chiller, or medical-device subnet.
• 6. Restrict Access to Specific Target IPs/Ports: A refrigeration vendor should reach only the refrigeration controller—never the entire plant VLAN.
• 7. Enable Video & Keystroke Session Recording: Log all remote administrative actions for audit and incident forensics.
• 8. Require Asset-Specific Maintenance Windows: Pair remote sessions with explicit operator notification and approval.
• 9. Verify Endpoint Hygiene: Require vendors to connect via managed, hardened jump-host browsers rather than bridging infected contractor laptops into OT.
• 10. Include Security Terms in Service Contracts: Require breach notification SLAs and adherence to your remote-access policy in annual maintenance agreements.