Full Report
Recommended guidelines on cyber security baseline requirements for Operational Technology (OT) systems were published in June 2026. I reviewed them... The post Offshore Norge 104: Network Engineering for OT Cybersecurity appeared first on Waterfall Security Solutions.
Analysis Summary
# Best Practices: Offshore Norge 104 (Network Engineering for OT)
## Overview
These practices address the baseline cybersecurity requirements for Operational Technology (OT) systems within the offshore and energy sectors. The guidelines focus on engineering out cyber risks through physical and logical network segmentation, emphasizing hardware-enforced unidirectionality and the elimination of unnecessary attack paths between IT and OT environments.
## Key Recommendations
### Immediate Actions
1. **Inventory Network Connections:** Identify all communication paths between OT and non-OT networks.
2. **Enforce "Strictly Necessary" Access:** Block all traffic except that which is "strictly necessary" and represents a "tolerable risk."
3. **Third-Party Isolation:** Immediately segment all supplier and third-party networks from core OT environments.
4. **Implement Island Mode:** Ensure a simple, executable mechanism is in place to physically or logically disconnect OT from external networks during a cyber emergency.
### Short-term Improvements (1-3 months)
1. **OT DMZ Establishment:** Implement a formal DMZ between enterprise IT and OT networks where all communications are terminated.
2. **Infrastructure Separation:** Migrate OT systems off shared IT virtualization infrastructure. OT systems shall reside on dedicated OT-only hypervisors.
3. **Management Traffic Segmentation:** Segregate administrative and management traffic from standard OT process traffic.
4. **Physical Switch Dedication:** Replace shared IT/OT switches with dedicated hardware for OT networks to ensure physical segmentation.
### Long-term Strategy (3+ months)
1. **Hardware-Enforced Unidirectionality:** Deploy Unidirectional Gateways at the IT/OT interface. Note: This can simplify compliance by potentially waiving conventional software-based DMZ requirements.
2. **Deterministic Remote Access:** Shift from software-only VPN/MFA solutions toward hardware-enforced network security for remote maintenance to eliminate file-transfer attack vectors.
3. **Risk-Based Architecture:** Align network design with "tolerable risk" assessments rather than just business convenience.
## Implementation Guidance
### For Small Organizations
- Focus on logical segmentation using VLANs if physical hardware is cost-prohibitive.
- Prioritize the "Island Mode" requirement by having a manual "kill switch" (physical disconnection) ready for emergencies.
### For Medium Organizations
- Implement dedicated physical switches for OT traffic.
- Establish a formal DMZ and ensure no IT virtualization resources are shared with OT controllers.
### For Large Enterprises
- Deploy hardware-enforced unidirectional gateways at all critical IT/OT boundaries.
- Automate the "Island Mode" response and integrate it into the SOC incident response playbook.
- Enforce strict hardware-based physical segmentation across all global offshore/onshore sites.
## Configuration Examples
- **OT DMZ Bypass:** If a hardware-enforced unidirectional gateway is used for OT-to-IT flows, the requirement to terminate all traffic in a software DMZ is waived.
- **Virtualization:** *Shall not* host OT VMs on the same physical host/cluster as IT VMs.
- **Segmentation:** Management traffic must be placed on a separate subnet/VLAN from process control traffic.
## Compliance Alignment
- **Offshore Norge 104 (Revision 7):** Primary standard.
- **IEC 62443:** Referenced regarding network zoning and conduits.
- **NIST CSF/800-82:** Alignment on OT segmentation and risk management.
- **TSA SD 1580/82:** Comparative alignment on "Island Mode" requirements.
## Common Pitfalls to Avoid
- **"Necessary" vs. "Strictly Necessary":** Avoid allowing connections just for convenience or minor cost savings; if it isn't vital to operations, it shouldn't exist.
- **Shared Infrastructure:** Assuming VLANs are sufficient for high-risk boundaries; the guideline prefers physical separation for critical OT switches.
- **Over-Reliance on Malware Scanning:** Do not rely on scanning to permit dangerous file transfers; hardware-enforced unidirectionality is the preferred deterministic protection.
- **Software-Only Islanding:** Logical disconnection can be bypassed by sophisticated malware; physical disconnection is the gold standard for emergencies.
## Resources
- **Offshore Norge 104 Guidelines:** `hXXps://www.offshorenorge.no/en/subject-matter/guidelines/guidelines/health-working-environment-safety/104-recommended-guideline/`
- **Waterfall Security OT Insights:** `hXXps://waterfall-security.com/ot-insights-center/`
- **TSA Security Directives (Pipeline/Rail):** `hXXps://www.tsa.gov/sites/default/files/signed_security_directive_1580_82-2022-01e_and_transmittal_memo_508c.pdf`