OT security is about reducing risk, not disrupting operations.
There is a moment in almost every OT cyber security project when someone proudly announces:
"We've hardened the system." Five minutes later, production stops, an HMI turns blue, a PLC loses communications and a very unhappy operations manager appears asking difficult questions. This highlights one of the biggest differences between IT and OT.
In enterprise IT, if a security change causes issues, users may lose access to email or experience application downtime. In OT, the consequences can be far more significant. Lost production, process disruption, equipment damage and safety considerations all come into play.
That's why device hardening in industrial environments isn't about applying every security control available. It's about reducing risk while maintaining safe and reliable operations.
The best OT engineers understand a simple truth:
Production stability is part of security.
Breaking the plant securely is still breaking the plant.
1. Start with Visibility Before Applying Controls
One of the most common mistakes organisations make is attempting to harden systems before they fully understand what exists in their environment.
Before making any changes, establish visibility across:
- Assets and operating systems
- Firmware versions
- Engineering workstations
- Network communications
- Remote access pathways
- Legacy and unsupported devices
Many organisations are surprised by what they discover.
Unmanaged laptops. Forgotten wireless access points. Unsupported servers. Engineering workstations containing software nobody wants to touch.
Every OT environment seems to have at least one mysterious device labelled:
"Do Not Turn Off." Nobody knows what it does. Nobody knows who installed it. Nobody is willing to test what happens if it's rebooted. Hardening without visibility creates unnecessary risk. A security team may disable a service that appears unused only to discover it supports a critical process that nobody documented.
Key takeaway: You cannot harden what you cannot see.
2. Focus on High-Value, Low-Risk Hardening Wins First
When people think about hardening, they often jump straight to complex security projects. In reality, some of the most effective improvements are also the safest.
Start with controls that reduce attack surface without changing how the system operates:
- Remove unnecessary software and services
- Disable unused USB ports
- Turn off Bluetooth and wireless interfaces that are not required
- Strengthen passwords
- Restrict local administrator accounts
- Improve logging and monitoring
- Remove obsolete applications
Industrial systems rarely need consumer applications, unused internet-facing services or software installed years ago for a project that no longer exists.
A particularly effective control in OT is application whitelisting through technologies such as AppLocker or Microsoft Defender Application Control.
If a workstation only ever needs ten approved applications, why allow anything else to execute? That said, test carefully. The engineering application used only once every six months during a shutdown is often the exact application that gets accidentally blocked. And nothing creates panic quite like discovering the critical engineering tool won't launch during a production outage.
Key takeaway: Remove unnecessary attack surface before introducing more aggressive controls.
3. Use Security Baselines as Guidance, Not as Gospel
When organisations begin hardening systems, the same frameworks usually appear:
- CIS Benchmarks
- Microsoft Security Baselines
- NCSC guidance
- DoD STIGs
All provide useful guidance. None should be applied blindly. For most OT environments, CIS Level 1 controls are often a sensible starting point because they strike a reasonable balance between security and operational functionality.
More aggressive controls can introduce unexpected side effects:
- Authentication failures
- Broken communications
- Application compatibility issues
- Loss of remote engineering access
- Legacy protocol disruptions
This is where OT differs significantly from traditional IT.
Many industrial systems still depend on technologies that modern security teams would rather retire.
Disabling DCOM may seem entirely reasonable until an older OPC server suddenly stops communicating.
Removing SMBv1 may be the correct long-term decision, but some industrial applications still depend on it.
The reality is that many OT environments contain systems that were installed when Windows XP was considered cutting-edge technology. Some were configured by engineers who retired years ago and took the tribal knowledge with them. Applying aggressive hardening without testing is a fantastic way to meet your operations manager under stressful conditions.
Good hardening isn't about ticking boxes. It's about understanding operational consequences.
Key takeaway: Apply security baselines gradually, test thoroughly and always maintain a rollback plan.
4. Strengthen the Network Around Systems You Cannot Harden
One of the greatest challenges in OT security is that some systems simply cannot be fully secured.
You will encounter assets that:
- Cannot be patched
- Cannot be upgraded
- Are no longer vendor supported
- Depend on legacy protocols
- Continue to perform critical operational functions
Attempting to force modern security controls onto these systems isn't always the right answer.
In many cases, a better approach is to secure the environment around them.
Focus on:
- Network segmentation
- Jump hosts
- Secure remote access
- Protocol-aware firewalls
- Centralised monitoring
- Virtual patching
This is where network security often delivers more value than endpoint hardening.
For example, traditional firewalls typically focus on IP addresses and ports. Protocol-aware industrial firewalls can inspect industrial communications and understand the difference between reading data and writing commands.
A Modbus device may need to support monitoring traffic, but not write operations. Being able to permit read commands while blocking write commands provides a far more useful security control than simply opening or closing a port. Virtual patching is equally important.
Many organisations cannot patch critical devices because:
- The vendor does not support it
- The plant cannot stop
- The software is obsolete
- The patch doesn't exist
- The patch causes operational problems
Rather than modifying the device itself, virtual patching reduces exposure through firewalls, intrusion prevention, protocol filtering and monitoring.
For legacy systems, containment is often more valuable than perfection. Trying to make an unsupported Windows XP workstation completely secure is a bit like trying to make a shopping trolley seaworthy. At some point, you're solving the wrong problem.
Key takeaway: If a device cannot be secured directly, secure the environment around it.
5. Build Long-Term Resilience Instead of Chasing Perfect Security
Device hardening is not a project that finishes. It is an ongoing engineering process.
Technology changes. New systems are introduced. Operational requirements evolve. Cyber threats continue to develop.
A sustainable hardening programme should include:
- Security assessments
- Configuration reviews
- Vulnerability management
- Centralised logging
- Technology refresh planning
- Continuous monitoring
It should also recognise an important reality. Some systems eventually become too expensive to protect.
There comes a point where the investment required to secure an obsolete asset exceeds the cost of replacing it.
These conversations are rarely comfortable, however, they are often necessary.
OT security maturity isn't measured by how many controls you've deployed. It's measured by how effectively you manage risk while supporting operations.
As many engineers have learned, something that looks excellent in a PowerPoint presentation can behave very differently at 2am on a production network.
Key takeaway: Focus on continuous improvement and resilience rather than pursuing perfect security.
Don't Forget the Simple Stuff
OT cyber security discussions often focus on advanced technologies, but some of the most effective controls remain surprisingly simple.
Examples include:
- USB port blockers
- Locked control cabinets
- BIOS passwords
- Disabled unused ports
- Restricted engineering connections
- Physical access controls
Sometimes a £4 USB blocker prevents more risk than an expensive security project.
Physical security may not be glamorous, but attackers rarely care whether the weakness they exploit is digital or physical.
Final Thoughts
Good OT device hardening isn't about achieving maximum security at all costs, it is about reducing exposure while maintaining safe and reliable operations.
The most successful organisations focus on:
- Reducing attack surface
- Improving resilience
- Limiting the impact of incidents
- Protecting critical production systems
- Supporting operational continuity
Ultimately, OT security is an engineering discipline. It requires balancing cyber security objectives with operational realities. The goal is not to create the most secure environment imaginable. The goal is to create the most secure environment that can still operate safely, reliably and efficiently.
Or, as many experienced engineers would put it: "The goal is resilient operations, not winning an argument with a benchmark spreadsheet."
