OT cyber security: what changed this year and what plants should do
New regulation in Europe and new attack patterns everywhere. A short, practical list for plant managers.
Halden Systems Newsroom - - 1 min read
Operational technology, the systems that run plants, used to be protected mostly by being separate from the internet. That is no longer true, and this year brought both new regulation and new attacks aimed squarely at plants.
What changed
- The NIS2 directive is now in force across the European Union and brings many mid-sized plants into scope for the first time, with personal liability for management.
- Attacks on remote access tools used by vendors, including ours, increased sharply. Several incidents we responded to this year started with a vendor's credentials.
- Ransomware groups have started targeting the engineering workstations that program controllers, rather than the controllers themselves.
What a plant should do first
- Know what is connected. Most plants we assess have 20 to 30 percent more devices on the network than their asset list says. You cannot protect what you have not counted.
- Segment. The office network and the plant network should not be able to see each other without passing through something you monitor.
- Control vendor access. Including Halden's. Time-limited, logged, approved per session. If a vendor cannot work that way, ask why.
- Have a plan for the day it happens. Who shuts what down, in what order, and how do you run the plant manually for a shift. Then rehearse it.
What not to do
Do not apply corporate IT patching policy to the plant without talking to the control engineers. A patch that reboots an engineering workstation mid-download can stop a line, and the fear of that is why so many plant systems are never patched at all. Patching needs a maintenance window and a rollback, like any other change to the plant.
Our OT security teams run assessments against this list; see the practice area page or talk to sales.
