Full Report
Owners of operational technology encouraged to address avoidable vulnerabilities, and build long-term cyber resilience.
Analysis Summary
# Best Practices: Securing Internet-Exposed OT and Edge Devices
## Overview
These practices address the increasing threat of disruptive cyber activity targeting Operational Technology (OT) and Industrial Control Systems (ICS). They focus on eliminating unintended internet exposure, hardening network boundaries, and migrating from legacy protocols to build long-term resilience for critical infrastructure and manufacturing environments.
## Key Recommendations
### Immediate Actions
1. **Audit Internet Exposure:** Verify that PLCs, HMIs, and other OT devices are not directly accessible via the public internet. Remove any discovered direct connections immediately.
2. **Credential Reset:** Change all default passwords on web interfaces, management consoles, and OT protocols.
3. **Disable Insecure Management:** Immediately stop using Telnet, SNMP v1, and SNMP v2 for device management.
### Short-term Improvements (1-3 months)
1. **Asset Inventory:** Build a definitive architecture view including all OT assets, communication pathways, and external connection points.
2. **Access Control Hardening:** Implement unique administrator accounts and enable Multi-Factor Authentication (MFA) for all supported corporate and OT-adjacent services.
3. **Patch Boundary Devices:** Update all firewalls, routers, and remote access appliances to the latest firmware and ensure they are within their vendor support lifecycle.
### Long-term Strategy (3+ months)
1. **Protocol Migration:** Move from insecure legacy protocols to secure versions (e.g., migrating Modbus to Modbus Security, or OPC DA to OPC UA).
2. **Network Segmentation:** Implement a segregated management network for boundary devices that is completely disconnected from the public internet.
3. **Lifecycle Management:** Establish a decommissioning schedule for End-of-Life (EOL) hardware that can no longer receive security updates.
## Implementation Guidance
### For Small Organizations
- Focus on visibility: Use simple network mapping to identify every connected device.
- Prioritize "low-hanging fruit" like changing default passwords and using a basic hardware firewall to block all inbound OT traffic.
### For Medium Organizations
- Implement a formal Vulnerability Management program.
- Focus on identity: Transition away from shared accounts to individual identities with public/private key authentication (e.g., SSH) where possible.
### For Large Enterprises
- Adopt the NCSC Cyber Assessment Framework (CAF) to measure resilience.
- Implement deep packet inspection and migrate complex industrial protocols (DNP3-SAv5, CIP Security) across distributed sites.
## Configuration Examples
*While specific code was not provided in the text, the guidelines mandate the following technical transitions:*
- **Industrial:** Replace `Modbus` (Cleartext) $\rightarrow$ `Modbus Security` (Encrypted/Auth).
- **Industrial:** Replace `OPC DA` (DCOM-based) $\rightarrow$ `OPC UA` (Certificate-based).
- **Management:** Replace `Password-only SSH` $\rightarrow$ `SSH with Public/Private Key`.
- **Management:** Replace `SNMP v1/v2` $\rightarrow$ `SNMP v3`.
## Compliance Alignment
- **NCSC Cyber Assessment Framework (CAF)**
- **NCSC Secure Connectivity Principles**
- **NIST/ISO Standards for OT Security** (implied via protocol hardening)
## Common Pitfalls to Avoid
- **Assumed Air-Gaps:** Assuming OT is inaccessible without verifying via active scanning or architecture review; "hidden" legacy connections often exist.
- **Shared Credentials:** Using the same password for multiple operators or keeping vendor-set defaults.
- **Boundary Neglect:** Leaving edge devices (VPNs, firewalls) unpatched, making them the primary entry point for attackers.
- **Insecure Protocol Reliance:** Continuing to use Telnet or unencrypted Modbus over open networks.
## Resources
- **NCSC Operational Technology Collection:** hxxps://www.ncsc.gov.uk/collection/operational-technology
- **Vulnerability Management Guidance:** hxxps://www.ncsc.gov.uk/collection/vulnerability-management
- **NCSC Cyber Assessment Framework (CAF):** hxxps://www.ncsc.gov.uk/collection/cyber-assessment-framework
- **MFA Implementation Guide:** hxxps://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfa