adesso: 7 Guiding Principles for Effective OT Security

From the Promise of Protection to Industrial Resilience 

OT security is often associated with the question of how to prevent cyberattacks. This question is valid, but too narrow. In modern production environments, it is more realistic to understand security as resilience. Companies must make attacks as unlikely as possible, but at the same time assume that incidents can still occur. What matters most, then, is that they are detected early, contained locally, and managed in a controlled manner.

This shift in perspective is important. A company can never immediately patch every vulnerability, replace every legacy system, or completely prevent all external access. Production environments have evolved over time, are heterogeneous, and are often designed for high availability. This is precisely why OT security requires a structured approach that combines technical protective measures with operational realities.

The following seven guiding principles form a pragmatic framework for this: Asset Management, Segmentation, Hardening, Backup & Recovery, IAM/PAM/Remote Access, Updates, and SIEM and Monitoring. Each principle addresses a different vulnerability. However, their effectiveness stems primarily from their interaction.

1. Asset Management: Only known systems can be protected

Asset management is the foundation of every OT security initiative. The reason is simple: What is not known cannot be assessed, protected, or monitored. However, blind spots exist in many production environments. Over the years, machines have been expanded, control systems retrofitted, interfaces created, service provider accesses set up, and temporary solutions kept in permanent use. From an operational perspective, this often works. From a security perspective, however, it creates a lack of transparency.

Robust asset management does more than just record device names. It documents systems, controllers, servers, network components, interfaces, software versions, communication relationships, responsibilities, and criticality levels. Of particular importance is the question of which systems are critical to the production flow and what dependencies exist between IT and OT. Only then does it become clear where risks arise and which protective measures should be prioritized.

Viewed critically, asset management is not a one-time inventory project. It must be understood as a continuous process. Every new machine, every new remote maintenance access point, and every interface to an MES, ERP, or data hub changes the security landscape. Without updates, an inventory quickly becomes a false sense of security. Therefore, asset management should be embedded in the organization and integrated with change management processes. 

2. Segmentation: Containing Attacks Locally

Segmentation is one of the most effective principles for limiting the impact of security incidents. The basic idea is this: Not every system should be allowed to communicate with every other system without restriction. Production areas, plant cells, control networks, IT systems, service provider access points, and data platforms should be separated into logical zones. Transitions between these zones must be controlled, documented, and monitored, because without segmentation, attacks can spread unchecked. A compromised computer, an infected server, or a misused remote access point can then become a springboard into other production areas. Segmentation, on the other hand, creates barriers. It does not prevent every attack, but it reduces its reach. In the event of an incident, the problem can be isolated without necessarily having to shut down the entire production process.

Technically, many options are available. In theory, a separate firewall could be placed in front of every machine and every piece of equipment. However, it is crucial that this effort be economically justified in relation to the criticality of the respective machine. Every additional component entails not only investment costs but, above all, ongoing operating expenses. Policies must be maintained, changes documented, malfunctions analyzed, and responsibilities clarified. An overly granular approach can slow down maintenance and, in the event of a failure, even become a barrier to availability itself.

A risk-based, tiered approach therefore makes sense: For highly critical facilities, bottleneck machines, or systems requiring special protection, a dedicated firewall or very fine-grained isolation may be appropriate. For less critical areas, coarser zones are often sufficient, supplemented by controlled transitions and monitoring. The appropriate level of segmentation is thus not purely a technical decision, but a business decision derived from criticality, the consequences of failure, and operational feasibility.

3. Hardening: Consistently Reducing the Attack Surface

Hardening means configuring systems in such a way that unnecessary risks are reduced. In practice, this involves seemingly simple but effective measures: changing default passwords, disabling unnecessary services, closing open ports, reducing user privileges, avoiding insecure protocols, limiting local administrative privileges, and documenting configurations. Every unnecessary function, interface, or connection increases the attack surface.

Hardening is particularly important in OT environments because systems are often operated for long periods and cannot be updated at any time. If an old system cannot be replaced or patched in the short term, preventable risks must at least be reduced. Hardening is thus a pragmatic security approach for established production environments.

However, it is critical that hardening not be carried out without proper testing. Changes to controllers, machine computers, or control systems can affect production processes. Therefore, coordinated standards, tests, approvals, and close collaboration between IT, OT, maintenance, and equipment manufacturers are essential. The goal is not maximum isolation at any cost, but rather secure configuration alongside stable operation.

4. Backup & Recovery: Making Restart Planning Possible

Even with good protective measures, a residual risk remains. That is why backup & recovery is a central guiding principle. It must be ensured that, in the event of an OT security incident, the relevant data for recovery is available. The crucial question, however, is not only whether data is backed up, but whether production can actually resume after an incident. In OT environments, recovery often involves more than just traditional server data: control programs, plant configurations, recipes, parameters, engineering projects, visualizations, and interface settings can be just as critical.

This means that backup and recovery are closely linked to asset management, since that is where it is defined which systems, data, and configurations actually exist and need to be backed up. Without knowing this scope, it cannot be systematically incorporated into the backup strategy. Blind spots in the inventory therefore directly lead to missing backups—and it is precisely these gaps that jeopardize the restart in an emergency.

Good backups must be created regularly, stored separately, and protected against tampering. Read-only or offline backups are particularly important to prevent ransomware from destroying the recovery foundation as well. Prioritization is equally important: Which systems must be restored first? Which systems are absolutely essential for recovery? What dependencies exist with regard to IT systems, service providers, or replacement parts?

The most critical aspect is testing. A backup that has never been restored is merely a hope in an emergency, not a reliable plan. Companies should therefore practice recovery processes, define recovery times, and clarify responsibilities. This transforms data backup into operational resilience.

5. IAM, PAM, and Remote Access: Controlling Access

Access points are one of the most important boundaries between the inside and the outside. In production environments, they are particularly sensitive because many stakeholders are involved: internal employees, maintenance, engineering, IT, external service providers, machine manufacturers, and integrators. Every instance of access may be necessary, but every instance of access can also be misused.

Identity and Access Management (IAM) ensures that users are uniquely identified and that permissions are controlled. Privileged Access Management (PAM) protects particularly powerful accounts, such as administrator or service accounts. Remote Access regulates external access, for example, for remote maintenance. Together, these measures pursue a single goal: Only authorized individuals should be able to access OT systems at the right time, for the right purpose, and with the minimum necessary privileges.

In practice, this means: no shared default accounts, strong authentication, time-limited access, logging, approval processes, regular reviews of access rights, and clear responsibilities. Remote maintenance access, in particular, should not remain open indefinitely but should be activated under controlled conditions, monitored, and closed again after use.

6. Updates: Addressing Known Vulnerabilities in a Structured Manner

Known vulnerabilities are among the most common points of entry. Nevertheless, updates in OT are challenging. Production systems cannot be restarted at will, equipment manufacturers must provide approvals, validations are required, and maintenance windows are limited. This creates a conflict of objectives: security vulnerabilities must be addressed without jeopardizing production stability.

An effective patching process therefore evaluates both risk and operational impact. Critical vulnerabilities must be prioritized. Where possible and if available, updates should be tested in test environments, coordinated with plant managers, and rolled out in a controlled manner. Where updates are not possible, compensatory measures must be implemented, such as segmentation, access restrictions, additional monitoring, or targeted hardening.

However, this is precisely where a typical OT challenge arises. Test systems often do not exist for equipment and control systems because machines are one-of-a-kind or manufacturer-specific, and replicating them is not economically feasible. As a result, testing effectively takes place on the production system, usually during a limited maintenance window. This makes robust rollback plans all the more important: backed-up baseline configurations, a documented fallback procedure, defined termination criteria, and clear accountability for the decision to roll back an update. In addition, a phased rollout—starting with a single machine or line before expanding to a broader scope—is helpful.

It is critical neither to ignore updates nor to install them in an uncontrolled manner. Both increase risks. The right approach lies in a transparent, risk-based process that combines security requirements with production realities.

7. SIEM and Monitoring: Early Detection Enables a Rapid Response

What is not visible cannot be defended. Many attacks initially go undetected because individual anomalies are not correlated or recognized as relevant patterns. Monitoring and Security Information & Event Management (SIEM) provide transparency here. They collect events, logs, and anomalies from various sources and help identify security-relevant patterns.

In OT environments, monitoring must be implemented with a sense of proportion. Active scans or unsuitable tools can disrupt sensitive systems. That is why OT-compatible methods, passive network monitoring, coordinated sensor technology, and a good understanding of production communications are important. The goal is not to generate as many alerts as possible, but to achieve relevant visibility.

Response processes are equally important. An alert without clear accountability is of little use. Companies should clarify who decides, in the event of a suspected incident, which systems may be isolated, how production is to be involved, and which escalation procedures apply. Monitoring only realizes its full value when it leads to a rapid and controlled response.

Conclusion: Impact Comes from Synergy 

The seven guiding principles are not an isolated list of measures. They form a coherent security framework. Asset management identifies what needs to be protected. Segmentation limits the spread of incidents. Hardening reduces avoidable attack surfaces. Backup & recovery ensure the ability to restore systems. IAM, PAM, and remote access control access. Updates patch known vulnerabilities. SIEM and monitoring make attacks visible and enable a rapid response.

From a management perspective, it is crucial not to treat OT security as a one-time project. Production environments are constantly changing: new systems, new interfaces, new service providers, new data flows, and new threats. That is why OT security requires governance, clear responsibilities, prioritization, and regular reviews.

How adesso supports you on the path to secure production

If you’re considering securing your production against cyber risks, assessing the OT security of your existing plant landscape, or developing a robust roadmap for secure production, please feel free to contact us—whether you’re just getting started or have already identified specific areas for action.

Our approach combines OT security requirements with the realities of production: high availability, long plant lifecycles, heterogeneous systems, vendor dependencies, and existing IT/OT interfaces are taken into account from the very beginning.

– – – – –

Related Links

👉 www.adesso.de  

Photo: unsplash