Managing Obsolescence in OT Modules: A Strategic Approach to Industrial Cyber Resilience

[Ahmet Ö.]

## Managing Obsolescence in OT Modules: A Strategic Approach to Industrial Cyber Resilience

Lifecycle visibility is critical for uncovering and resolving hidden vulnerabilities in legacy technology assets within industrial facilities.

### Introduction: The Silent Threat in Industrial Facilities

In critical infrastructure sectors such as petrochemicals, power generation, water treatment, and manufacturing plants, many OT (Operational Technology) assets continue to operate invisibly. However, many of these pieces of equipment, such as PLCs, HMIs, servers, and network devices, contain old or end-of-life parts that no longer receive manufacturer support, firmware updates, or security patches. This situation reduces device reliability over time and increases security vulnerabilities.

### Deep Asset Inventory: Integrating Lifecycle Attributes

A robust asset inventory forms the foundation for OT cybersecurity and lifecycle management. While traditional inventories include static information such as name, manufacturer, or IP address, comprehensive inventories cover parameters such as lifecycle status, manufacturer support, EOL (end-of-life) dates, OT zone classification, and criticality level. This allows for a detailed analysis of asset status.

### Uncovering Hidden Obsolescence Risk with Operational and Cyber Parameters

Lifecycle status alone does not fully reflect risks. For this reason, four basic parameters are evaluated for each asset:

• Hardware factor: Physical health, component obsolescence, and spare parts status
• Application factor: Its role within the control system and the stability of supporting software
• Cyber factor: Patch status, authentication, and network connection security
• Performance factor: Operational behavior, communication, and error patterns

These interrelated parameters provide a comprehensive view of the asset's operational and cyber resilience.

### Measuring Lifecycle Risk with Weighted Scoring

Each parameter is weighted to reflect its impact on lifecycle risk. Hardware has the highest priority because physical degradation directly affects reliability. Application and cyber factors are equally important for operational resilience and security. Performance is a supporting indicator.

### Truly Assessing Risk with the Criticality Factor

While the lifecycle score reflects the internal health of an asset, it does not fully demonstrate its operational impact. This is where the criticality factor comes into play. Assets affecting production, safety shutdowns, and compliance functions receive a high criticality score and are multiplied by 2.0, medium criticality by 1.5, and low by 1.0. This prioritizes the risks of critical assets.

### Conclusion: Cyber Resilience Strengthened by Proactive Lifecycle Management

Obsolete OT assets pose significant risks in industrial facilities that are often overlooked. These risks cannot be detected with a basic inventory. By creating a comprehensive inventory that includes lifecycle intelligence, risks can be quantified, priorities can be set, and investments can be strategically planned.

Weighted scoring and criticality mapping clarify which assets require immediate intervention, which should be included in long-term plans, and which can continue with low risk.

This structured and data-driven approach enables organizations to move from reactive maintenance to proactive lifecycle management. This strengthens cybersecurity, reduces unplanned downtime, and increases overall operational resilience.

In the industrial world, lifecycle visibility forms the foundation of modern cyber resilience and is indispensable for secure operations.