🚨 How to Protect Your OT Infrastructure Against PLC Attacks? 🚨

[Elif Özaksu]

Why Is Visibility Key in OT Security?​

Vulnerabilities in OT systems and a lack of cybersecurity expertise increase the potential for cyber incidents. Third-party access, in particular, emerges as an overlooked attack surface. The first step to closing these vulnerabilities is to ensure asset visibility.

• PLCs and remote terminal units
  
• Human-machine interfaces (HMIs) and engineering workstations
  
• Industrial switches
  
• Remote access gateways and wireless connections
  
• Third-party connections
  

In many OT assessments, the most significant findings are not complex cybersecurity risks, but rather unknown devices, forgotten remote access paths, outdated engineering stations, and unsupported systems. Before implementing advanced cybersecurity measures, identifying existing systems is essential.

Defense-in-Depth Model: Layered Security​

The Defense-in-Depth model is a strategic approach to protecting systems and networks from various threats. Multiple layers of security are applied to recognize, prevent, or mitigate potential attacks at different levels. A single security measure is not sufficient to fully protect a system.

Track PLC Logic Changes​

Attackers don't need custom malware to disrupt a process. Changing setpoints, alarm limits, control logic, communication settings, or safety functions can directly impact the physical process. Network monitoring alone cannot catch this. Your organization should consider whether it has the following mechanisms:

• Monitoring changes in controller logic
  
• Performing configuration changes
  
• Making firmware updates
  
• Adjusting security-related parameters
  
• Engineering workstation downloads
  
• Making changes to communication configuration
  

In the event of an unexpected change in the controller program, the organization needs to be notified immediately, not weeks later during troubleshooting.

Establish a verified baseline of controller logic and configuration, then continuously compare operational assets against it. Track changes in firmware, security parameters, and engineering workstation downloads.

Every deviation should answer three questions: who changed it, when was it changed, and was it approved? You want to learn about an unauthorized change within minutes, not weeks later during troubleshooting. For many operators, an unexpected logic change is more actionable than thousands of flagged IP connections.

Focus on Recovery, Not Just Prevention​

Many cybersecurity discussions focus on prevention. However, resilience is about the ability to recover. No program can stop every incident, so the ability to recover is the true measure of resilience. Ask a simple question: When was the last time we restored a PLC from a backup? Many organizations meticulously back up but never test restoration. Drills should cover:

• Controller programs
  
• HMI configurations
  
• Historian databases and SCADA servers
  
• Engineering workstation images
  
• Network device configurations
  

Being able to restore quickly can mean the difference between a brief outage and a public safety incident.

Limits of Voluntary Guidance and Implementation Challenges​

Over the past decade, many cybersecurity recommendations have been published by government agencies and industry organizations. While most are technically sound, the challenge lies in implementation. Implementation is particularly difficult for small municipal utilities due to a lack of personnel. Documents state what to do but rarely specify who will do it:

• Who approves remote access and who audits third-party accounts?
  
• Who approves controller logic changes and backups?
  
• Who conducts recovery drills and who maintains the asset inventory?
  

Without named owners, organizations become compliant on paper but fragile in practice, and even robust programs break down. Many "technical" failures are actually management failures.

The Overlooked Lesson: Expertise and Accountability​

Recent PLC-related incidents affecting critical infrastructure operators should not be seen as evidence of a new threat. They are evidence of old problems, listed below:

• Internet-accessible operational assets
  
• Poorly managed remote access
  
• Weak asset visibility
  
• Untested recovery procedures
  
• Lack of OT cybersecurity expertise
  

These are systemic issues present across critical infrastructure. The organizations that will increase their resilience in the next decade are not those that spend the most on cybersecurity, but those that understand their operational environments, possess OT-specific expertise, maintain asset visibility, and regularly verify their ability to recover from incidents.

Because resilience in OT cybersecurity is not about avoiding attack; it's about continuing operations even in the event of an attack.

The most disturbing aspect of recent PLC attacks is not what was discovered, but how similar it is to what has been observed in the industry for over a decade. Internet-accessible assets, unmanaged remote access, limited asset visibility, and untested recovery are not new problems. Technologies to address these issues are widely available today.

What has not yet happened is the translation of cybersecurity recommendations into practice, and this is especially true for small utilities and municipalities operating under constraints.