LADX
Start free
← Resources
Practice·7 min read·

Security for control systems, without the theatre

A short list of things that genuinely reduce risk on an OT network, and the ones that only look like they do.

Short answer

The measures that matter most are segmentation from the business network, removing default credentials, keeping controllers in RUN rather than REMOTE, and controlling who can physically reach the panel. Most control systems fail on the basics rather than on anything sophisticated, and an internet-exposed HMI is still the most common serious finding.

Which protocol sits whereENTERPRISEOPC UAMQTTCONTROLEtherNet/IPPROFINETModbus TCPDEVICEIO-LinkPROFIBUS DPModbus RTUEthernet carries most of it now, which is why the layers blur.

Control system security fails on fundamentals far more often than on anything advanced.

The four that matter most

  • Segmentation. The control network should not be reachable from the business network without passing something that inspects the traffic.
  • Default credentials. Every HMI, every managed switch, every VFD web interface. This is the single most common finding.
  • Key position. A controller left in REMOTE can be reprogrammed over the network. In RUN it cannot.
  • Physical access. A locked panel defeats more attacks than most software controls.
If you do only these four, you have removed most of the realistic risk.

What air gaps actually do

They help, and they leak. Engineering laptops move between networks. USB drives cross. Vendor support connects temporarily and the connection stays.

An air gap is a strong control, not a guarantee, and treating it as a guarantee is how the leaks go unexamined.

What is mostly theatre

Antivirus on an HMI that cannot be updated. Password policies on a shared operator account everybody knows. Anything that adds friction without changing who can reach what.

Common questions

Should PLCs be connected to the internet?
No, and the fact that this still needs saying is why it is the first item on every audit. If remote access is genuinely required, it goes through a VPN with multi-factor authentication into a segmented network, never by exposing a controller or an HMI directly.
Does an air gap make a control system secure?
It helps enormously and it is rarely as complete as people believe. Engineering laptops, USB drives, vendor remote support and temporary connections during commissioning all cross the gap routinely. Treat it as one strong control among several rather than as a guarantee.

Keep reading