Is Your Plant's OT Security Stuck in a Legacy Protocol Trap?

The Question That Keeps Me Up at Night

Imagine you're a controls engineer at a mid-sized food and beverage plant. You've just connected your PROFINET line to a new IIoT dashboard, and the VP of operations is thrilled. But the next morning, you get a call: the plant's OT network has been flagged by CISA for a known vulnerability. Your heart sinks. You didn't even know you had a vulnerability.

This scenario isn't hypothetical. CISA's Known Exploited Vulnerabilities catalog is the authoritative source for what's actually being exploited in the wild, and it's full of ICS-related flaws. The harsh truth is that many of us are running on protocols designed decades ago, when security wasn't even a consideration. My question is direct: Are you still betting your plant's uptime on a protocol that predates the internet? I think you are, and I'm going to argue that it's time to stop.

I'm not here to scare you—I'm here to give you a concrete path forward. The answer isn't to rip out your fieldbus, but to layer security properly and, where you can, move to modern, secure communication. Let's get into it.

Why Your Fieldbus Is a Security Liability

Let's start with the elephant in the room: Modbus. Developed in the late 1970s, it's a master-slave register-based protocol that supports serial and Ethernet transport (OPC Foundation). It's ubiquitous, but it was never designed with security in mind. There's no built-in encryption or authentication—anyone who can reach your network can read and write to your registers. The Modbus Organization calls it the world's most widely adopted industrial communication protocol, but that's a legacy, not a feature.

PROFINET and EtherNet/IP aren't much better out of the box. PROFINET, from Siemens and PI, does support real-time and isochronous real-time classes for motion control (OPC Foundation), but it doesn't mandate security. EtherNet/IP runs the Common Industrial Protocol (CIP) over standard Ethernet and TCP/UDP (OPC Foundation), and while it's popular in North America on Rockwell platforms, it also lacks built-in security unless you specifically enable CIP Security. ODVA says CIP Security can help you comply with IEC 62443 and the EU CRA, but that's an add-on, not a default.

Meanwhile, CISA warns that many legacy ICS devices use outdated operating systems and older protocols that lack encryption or authentication, and they specifically call out brownfield deployments—layering legacy infrastructure with modern OT systems—as a unique challenge (CISA). This is the trap: we're connecting these old protocols to the internet of things without securing the fundamentals.

So, the first part of my answer is: don't rely on your fieldbus for security. It was never designed to be secure, and pretending otherwise is dangerous.

What You Should Be Running at the Edge and Beyond

For data leaving the plant floor, you need protocols that were built for security from the ground up. That's where OPC UA and MQTT come in. OPC UA is a vendor-neutral, platform-independent standard with built-in encryption and authentication (OPC Foundation). It's also standardized as IEC 62541 and is designed to carry data securely up to MES/ERP systems (IEC 62541 OPC UA Standard). MQTT, standardized as ISO/IEC 20922, is a lightweight publish/subscribe messaging transport that supports encryption with TLS and client authentication via OAuth (MQTT.org).

Here's the layering reality: Modbus, PROFINET, and EtherNet/IP connect field devices and PLCs, while OPC UA and MQTT carry data securely to SCADA, MES, and cloud systems (OPC Foundation). That's the architecture you should aim for—use the fieldbus for what it's good at (fast, deterministic control) and use OPC UA or MQTT for anything that leaves the control zone.

But don't think that just switching to OPC UA makes you invulnerable. You still need to configure it properly, and you need to secure the whole stack. That's where ISA/IEC 62443 comes in. The ISA/IEC 62443 series defines requirements for implementing and maintaining electronically secure industrial automation and control systems (IACS), and it's the global benchmark (ISA/IEC 62443). It sets requirements for asset owners, suppliers, integrators, and service providers—so everyone has a role.

If you're in North America, you should also be looking at NIST SP 800-82 Rev. 3, the Guide to OT Security, which provides guidance on securing OT including ICS, SCADA, DCS, and PLCs (NIST). It's not a standard, but it's the de facto framework for OT security in the US.

How to Secure Your Existing Fieldbus Without a Rip-and-Replace

I get it—you can't just replace every Modbus slave in your plant. That's why you need a defense-in-depth approach. Here's my practical recommendation:

• Segment your network: Put your fieldbus devices on isolated VLANs or separate physical networks, and control traffic between zones with firewalls.
• Use secure remote access: If you need to access a PLC remotely, use a VPN with strong authentication, not a direct open port.
• Upgrade to secure protocols where possible: For new installations, choose EtherNet/IP with CIP Security enabled, or consider EtherCAT or Sercos if you need deterministic motion, but make sure you configure the security features.
• Implement monitoring: Deploy an intrusion detection system that can see OT traffic, and watch for anomalies.

For example, let's say you have a packaging line with 50 EtherNet/IP devices. If you enable CIP Security on those devices, you can encrypt communication and authenticate devices, which helps you meet IEC 62443 requirements (ODVA). That's a concrete step you can take without changing your PLC code.

Another option: for new motion control applications, EtherCAT offers hardware-based synchronization with jitter below 1 µs (EtherCAT Technology Group), and Sercos provides synchronization accuracy much less than 1 µs with configurable cycle times (Sercos International). Both support safety functions up to SIL 3 (EtherCAT Technology Group, Sercos International). These are modern, secure-by-design protocols—though you still need to configure them securely.

But here's a warning: don't assume that just because a protocol has a safety standard, it's automatically cyber-secure. Safety and security are different domains. You need both.

My Verdict: Stop Ignoring the Legacy Protocol Problem

The industrial automation market is booming—it's expected to grow from $184.43 billion in 2025 to $326.48 billion by 2032 (Maximize Market Research), and the IIoT market is growing even faster. But with growth comes attack surface. CISA notes that exploitation of ICS vulnerabilities can lead to data corruption, exfiltration, or significant physical consequences (CISA). That's not a risk I'm willing to take.

So here's my specific recommendation: Do a security audit of your OT network today. Identify every legacy protocol in use, and for anything that touches the internet or a business network, require OPC UA or MQTT with TLS. For field-level devices, enable security features if they exist—like CIP Security for EtherNet/IP. And if you're procuring new equipment, demand that it supports secure communication. CISA's Secure by Demand guidance recommends procuring products with open standards, secure configurations, data protection, and strong authentication (CISA). Follow that.

You don't have to rip out your Modbus network, but you do have to stop pretending it's secure. The days of air-gapped industrial networks are over, and the quicker we accept that, the better we can protect our plants.

Quick tip: Start by mapping your network—you can't secure what you don't know exists. Use a tool like Wireshark to capture traffic on a mirror port for a day, and you'll be surprised what you find.

Sources

• OPC Foundation - https://opcfoundation.org/
• ISA/IEC 62443 - https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
• NIST SP 800-82 Rev. 3 - https://csrc.nist.gov/pubs/sp/800/82/r3/final
• CISA Industrial Control Systems - https://www.cisa.gov/topics/industrial-control-systems
• ODVA EtherNet/IP - https://www.odva.org/technology-standards/key-technologies/EtherNet-ip/
• MQTT.org - https://mqtt.org/