7 guiding principles for effective OT security

There is no such thing as absolute security in networked production environments, at least not without incurring exorbitant costs. A pragmatic approach is therefore crucial: identifying risks, reducing attack surfaces, protecting critical areas, preparing for recovery and detecting attacks at an early stage. This blog post presents 7 guiding principles for building OT security systematically and effectively.

From the promise of protection to industrial resilience

OT security is often associated with the question of how to prevent cyberattacks. This is a valid question, but it is too narrow. In modern production environments, it is more realistic to view security as resilience. Companies must make attacks as unlikely as possible, whilst at the same time assuming that incidents may still occur. It is then crucial that they are detected early, contained locally and managed in a controlled manner.

This shift in perspective is important. A company can never immediately close every vulnerability, replace every legacy system or completely avoid all external access. Production environments have evolved organically, are heterogeneous and are often designed for high availability. This is precisely why OT security requires a structured approach that combines technical protective measures with operational realities.

The following seven guiding principles form a pragmatic framework for this: asset management, segmentation, hardening, backup and recovery, IAM/PAM/remote access, updates, and SIEM and monitoring. Each principle addresses a different vulnerability. However, their effectiveness stems primarily from their interaction.

1. Asset Management: Only known systems can be protected

Asset management is the foundation of any OT security initiative. The reason is simple: what is not known cannot be assessed, protected or monitored. In many production environments, however, there are blind spots. Machines have been expanded over the years, control systems retrofitted, interfaces created, service provider access set up and temporary solutions kept in permanent use. From an operational perspective, this often works. From a security perspective, however, it creates a lack of transparency.

Robust asset management does more than just record device names. It documents plant equipment, control systems, servers, network components, interfaces, software versions, communication links, responsibilities and criticality levels. Of particular importance is the question of which systems are crucial to the production flow and what dependencies exist between IT and OT. Only then does it become clear where risks arise and which protective measures should be prioritised.

Viewed critically, asset management is not a one-off inventory project. It must be understood as a continuous process. Every new machine, every new remote maintenance access point, every interface to an MES, ERP or data hub alters the security landscape. Without regular updates, an inventory quickly becomes a false sense of security. Asset management should therefore be embedded within the organisation and linked to change management processes.

2. Segmentation: Containing attacks locally

Segmentation is one of the most effective principles for limiting the impact of security incidents. The basic principle is that not every system should be allowed to communicate with every other system without restriction. Production areas, plant cells, control networks, IT systems, service provider access points and data platforms should be divided into logical zones. Transitions between these zones must be controlled, documented and monitored, as without segmentation, attacks can spread unchecked. A compromised computer, an infected server or a misused remote access point can then become a springboard into other production areas. Segmentation, on the other hand, creates barriers. It does not prevent every attack, but it reduces its reach. In the event of an incident, the problem can be isolated without necessarily having to halt the entire production process.

Technically, a great deal is possible. In theory, a separate firewall could be installed in front of every machine and every piece of plant. However, it is crucial that this expenditure is economically justified in line with the criticality of the machine in question. Every additional component entails not only capital expenditure but, above all, ongoing operational costs. Regulations must be maintained, changes documented, faults analysed and responsibilities clarified. Overly fine-grained segmentation can slow down maintenance and, in the event of a fault, even become a barrier to availability itself.

A risk-based, tiered approach is therefore advisable: For highly critical installations, bottleneck machines or systems requiring special protection, a dedicated firewall or very fine-grained isolation may be appropriate. For less critical areas, coarser zones are often sufficient, supplemented by controlled transitions and monitoring. The correct level of segmentation is therefore not a purely technical decision, but a business decision derived from criticality, the consequences of failure and operational feasibility.

3. Hardening: Consistently reducing the attack surface

Hardening involves configuring systems in such a way as to reduce unnecessary risks. In practice, this involves seemingly simple but effective measures: changing default passwords, disabling unnecessary services, closing open ports, restricting user rights, avoiding insecure protocols, limiting local administrative rights and documenting configurations. Every unnecessary function, interface or connection increases the attack surface.

Hardening is particularly important in OT environments because systems are often operated for long periods and cannot be updated at any time. If an old system cannot be replaced or patched in the short term, avoidable risks must at least be reduced. Hardening is therefore a pragmatic approach to protection for established production environments.

However, it is crucial that hardening is not carried out without proper verification. Changes to controllers, machine computers or control systems can affect production processes. This is why coordinated standards, tests, approvals and close collaboration between IT, OT, maintenance and plant manufacturers are required. The aim is not maximum isolation at any cost, but secure configuration whilst ensuring stable operation.

4. Backup & Recovery: Making restart planning possible

Even with good protective measures, a residual risk remains. That is why backup & recovery is a key guiding principle. It must be ensured that, in the event of an OT security incident, the relevant data for recovery is available. The crucial question, however, is not merely whether data is backed up, but whether production can actually resume after an incident. In OT environments, recovery often involves more than just traditional server data: control programmes, plant configurations, recipes, parameters, engineering projects, visualisations and interface settings can be just as critical.

Backup and recovery are therefore closely linked to asset management, as this is where it is defined which systems, data and configurations actually exist and need to be backed up. Without knowing the full scope, it is impossible to systematically incorporate it into the backup strategy. Blind spots in the inventory therefore directly lead to missing backups – and it is precisely these gaps that jeopardise a successful restart in the event of an emergency.

Good backups must be created regularly, stored separately and protected against tampering. Read-only or offline backups are particularly important to ensure that ransomware does not also destroy the basis for recovery. Prioritisation is equally important: which systems must be brought back online first? Which systems are absolutely essential for recovery? What dependencies exist with regard to IT systems, service providers or spare parts?

The most critical aspect is testing. A backup that has never been restored is merely a hope in an emergency, not a robust plan. Companies should therefore practise recovery processes, define recovery times and clarify responsibilities. This transforms data backup into operational resilience.

5. IAM, PAM and Remote Access: Controlling Access

Access points are one of the most important boundaries between the internal and external environments. In production environments, they are particularly sensitive because many parties are involved: internal staff, maintenance, engineering, IT, external service providers, machine manufacturers and integrators. Every instance of access may be necessary, but every instance of access can also be misused.

Identity and Access Management (IAM) ensures that users are uniquely identified and that permissions are controlled. Privileged Access Management (PAM) protects particularly powerful accounts, such as administrator or service accounts. Remote access regulates access from outside the organisation, for example for remote maintenance. Together, these measures pursue a single goal: only authorised persons should be able to access OT systems at the right time, for the right purpose and with the minimum necessary level of rights.

In practice, this means: no shared standard accounts, strong authentication, time-limited access grants, logging, approval processes, regular reviews of access rights and clear lines of responsibility. Remote maintenance access, in particular, should not be left open permanently, but should be activated in a controlled manner, monitored and closed again after use.

6. Updates: Addressing known vulnerabilities in a structured manner

Known vulnerabilities are among the most common points of entry. Nevertheless, updates in OT are challenging. Production systems cannot be restarted at will, plant manufacturers must give approval, validations are required and maintenance windows are limited. This creates a conflict of objectives: security gaps must be closed without jeopardising production stability.

An effective patching process therefore assesses both risk and operational impact together. Critical vulnerabilities must be prioritised. Where possible, and where available, updates should be tested in test environments, coordinated with plant managers and rolled out in a controlled manner. Where updates are not possible, compensatory measures must be put in place, such as segmentation, access restrictions, additional monitoring or targeted hardening.

However, this is precisely where a typical challenge in OT arises. Test systems often do not exist for plant equipment and control systems because machines are one-offs or manufacturer-specific, and replicating them is not economically viable. Testing then effectively takes place on the production system, usually within a tight maintenance window. This makes robust rollback plans all the more important: backed-up baseline configurations, a documented fallback procedure, defined termination criteria and clear accountability for the decision to roll back an update. In addition, a phased rollout helps, initially covering a single machine or line before being rolled out more widely.

It is crucial neither to ignore updates nor to install them in an uncontrolled manner. Both increase risks. The correct approach lies in a transparent, risk-based process that combines security requirements with production realities.

7. SIEM and Monitoring: Early Detection Enables a Rapid Response

What cannot be seen cannot be defended. Many attacks initially go undetected because individual anomalies are not correlated or recognised as relevant patterns. Monitoring and Security Information & Event Management (SIEM) provide transparency here. They collect events, logs and anomalies from various sources and help to identify security-relevant patterns.

In OT environments, monitoring must be implemented with a sense of proportion. Active scans or unsuitable tools can disrupt sensitive systems. That is why OT-compatible methods, passive network monitoring, carefully selected sensors and a good understanding of production communications are important. The aim is not to generate as many alerts as possible, but to achieve relevant visibility.

Response processes are equally important. An alert without clear accountability is of little use. Organisations should clarify who, in the event of a suspected incident, decides which systems may be isolated, how production is to be involved, and which escalation procedures apply. Monitoring only realises its full value when it leads to a rapid and controlled response.

Conclusion: Impact arises from synergy

The seven guiding principles are not a list of isolated measures. They form a coherent security framework. Asset management identifies what needs to be protected. Segmentation limits the spread of incidents. Hardening reduces avoidable attack surfaces. Backup and recovery ensure the ability to restore systems. IAM, PAM and remote access control access. Updates close known vulnerabilities. SIEM and monitoring make attacks visible and enable a rapid response.

From a management perspective, it is crucial not to treat OT security as a one-off project. Production environments are constantly changing: new systems, new interfaces, new service providers, new data flows and new threats. That is why OT security requires governance, clear responsibilities, prioritisation and regular reviews.

How adesso supports you on the path to secure production

If you are considering securing your production against cyber risks, assessing the OT security of your existing plant landscape, or developing a robust vision for secure production, please do not hesitate to contact us – whether you are just starting out or have already identified specific areas for action.

Our approach combines OT security requirements with the realities of production: high availability, long plant life cycles, heterogeneous systems, dependencies on manufacturers and existing IT/OT interfaces are taken into account right from the start.