OT security basics for automation engineers

Industrial systems are attacked the same way as office IT — but a compromised controller can damage equipment and people. Most effective measures are organisational and architectural, not exotic products.

Zones and conduits (IEC 62443)

Group assets with similar security needs into zones (e.g. cell controllers, SCADA servers, safety system) and allow communication only through defined conduits with firewalls. A DMZ between plant and office networks hosts the systems both sides need (historian replica, patch server, remote access gateway) — no direct office-to-PLC connections.

Ten practical measures

1. Inventory: list of all devices, firmware versions and network connections.
2. Segmentation with VLANs and firewalls; deny by default between zones.
3. Remote access only through a managed gateway with MFA and session logging — no permanently open VPNs or vendor modems.
4. Change default passwords; use controller protection levels (read/write protection, PUT/GET only where needed).
5. Separate user accounts on HMI/SCADA with roles; no shared "admin".
6. Disable unused services and ports (web servers, FTP, Telnet, SNMP v1/v2 write).
7. Patch where possible, with a tested process; otherwise compensate with segmentation.
8. Removable media control (USB) and malware scanning for engineering laptops.
9. Backups of all configurations, tested restores (see the backup article).
10. Monitoring: logs, alarms on configuration changes, network anomaly detection where justified.

Ask your suppliers

Supported OS and patch policy, product security certifications (e.g. IEC 62443-4-1/4-2), hardening guides, required ports and accounts, secure remote-service concept.