OT and IoT Security for Manufacturing: Protecting Systems That Cannot Be Patched

Applying IT security practice to a factory floor fails quickly. Vulnerability scanning can crash a programmable logic controller. Patching may void vendor certification. Downtime for a maintenance window costs more per hour than the security programme's annual budget. And the equipment in question may have been commissioned before the current security team was hired.

Effective OT security accepts these constraints and builds around them.

Understand the different priorities

The consequence is that the standard IT playbook — scan, patch, endpoint agent — is largely unavailable, and the programme must lean on architecture instead.

Step one: passive visibility

Most manufacturers cannot produce an accurate list of what is on the plant network. Build it passively, using network traffic analysis and span ports rather than active scanning, and capture device type, firmware version, communication partners, protocols in use, and any path to the corporate network or the internet.

The discovery findings are consistently uncomfortable: engineering laptops bridging both networks, cellular modems installed by vendors for support, unmanaged switches nobody documented, and devices communicating outbound to vendor cloud services through paths no one approved.

Step two: segmentation that reflects the process

Segmentation is the highest-value control available because it limits what a compromise can reach. Use a zone and conduit model: separate enterprise IT, a demilitarised zone for shared services and historians, plant supervisory systems, and control-level devices, with all traffic between zones passing through inspected, explicitly permitted conduits.

Two rules keep it practical. No direct enterprise-to-control communication — everything traverses the DMZ. And segment by process cell as well as by level, so an incident in one production line does not propagate to the rest of the plant.

Step three: control remote and vendor access

Vendor remote access is the most common intrusion path into OT environments, because it is often permanent, shared, and unmonitored. Replace it with brokered access: identity-verified, time-bounded, session-recorded, approved per request by plant staff, and technically incapable of reaching anything beyond the specific device being serviced. Remove standing vendor VPN accounts and any cellular modem not registered and controlled.

Step four: compensating controls for unpatchable assets

• Protocol-aware filtering. Restrict which commands may cross a conduit, not merely which addresses.
• Anomaly monitoring. OT traffic is highly repetitive, which makes deviation detection unusually effective.
• Application allow-listing on engineering workstations and human-machine interfaces, where agents are supported.
• Removable media control, still a genuine infection vector in air-gapped plants.
• Configuration backup and validated restore for controller logic, tested at least annually.
• Physical access control to panels and network ports.

Governance and joint ownership

OT programmes fail on organisational lines more often than technical ones. Plant engineering owns availability and safety; security owns threat expertise; neither can succeed alone. Establish joint ownership with a shared risk register, run change control that includes both parties, and align on a standard such as IEC 62443 so requirements are expressed in language plant engineers recognise.

Include OT explicitly in incident response, with scenarios that cover safe shutdown, manual operation, and the decision authority to halt production. In a real event, that decision belongs to plant leadership, and rehearsing it beforehand is the difference between a contained incident and a prolonged outage.

Frequently asked questions

Why is OT security different?

It prioritises safety and availability, involves equipment lasting decades that often cannot be patched without downtime or recertification, and relies on protocols designed without authentication.

How do you secure unpatchable systems?

Compensating controls: segmentation, strict remote and vendor access brokering, passive anomaly monitoring, protocol-aware filtering, and physical access restriction.

What is the first step?

Passive asset discovery. Without an accurate inventory of devices, firmware, and traffic flows, no other control can be scoped correctly.

Can we run vulnerability scans on the plant network?

Not with standard active scanning — it can disrupt or crash control devices. Use passive discovery and vendor-validated assessment methods instead.