Stop Blaming the Protocol: Fix Your OT Network Configuration First

We've all been there: the line goes down, the HMI shows nonsense, and someone mutters, "It's the protocol." They're wrong. The protocol didn't change. The configuration did. In fact, the global industrial automation market is projected to hit $326.48 billion by 2032 (Maximize Market Research), and yet we still chase protocol boogeymen instead of checking our own settings. Let's stop the blame game and talk about what actually fixes OT networks: configuration discipline.

The Protocol Problem Is a Configuration Problem

Every protocol—Modbus, PROFINET, EtherNet/IP, OPC UA, MQTT—has a job. Modbus has been hauling register data since the 1970s (OPC Foundation). PROFINET handles real-time motion control. EtherNet/IP dominates North American plants. These protocols work. They've been proven for decades. The issue is how we deploy them.

I've seen a plant where a PLC was talking to a sensor over Modbus TCP, but someone had set the wrong IP address and the sensor was actually a coffee machine. That's not a protocol failure; that's a configuration error. And it's not rare. The ISA/IEC 62443 standards exist precisely because we keep making the same mistakes—weak authentication, insecure settings, outdated protocols (CISA).

Why We Keep Blaming the Protocol

It's easier to blame the tool than the user. When a network misbehaves, we want a magic bullet: "If we just switch to OPC UA, all our problems will vanish." But OPC UA has built-in encryption and authentication (OPC Foundation) and still won't help if you leave the default password on your engineering workstation.

The market growth feeds this myth. The Industrial IoT automation market is expected to reach $301.38 billion by 2032 (Maximize Market Research). We're spending billions on new tech, but if we don't fix the basics, we're just buying faster horses.

What Actually Goes Wrong in the Field

• Wrong IP addresses or subnet masks
• Forgotten default credentials on PLCs and HMIs
• Unused ports left open
• No segmentation between IT and OT
• Misconfigured quality-of-service on MQTT brokers

These aren't protocol issues; they're human issues. And they're exactly what ISA/IEC 62443 was designed to address—it bridges the gap between IT and OT, and between process safety and cybersecurity (ISA/IEC 62443).

The Strongest Counter-Argument: "But the Protocol Is Old"

I hear it: "Modbus is 50 years old and has no security." True, Modbus is ancient, but it's still everywhere because it works. The fix isn't to rip it out—it's to put a modern layer on top. Use OPC UA to carry Modbus data securely to the cloud. Or use MQTT, which is lightweight and can run on small microcontrollers (MQTT.org).

But here's the catch: even MQTT, which supports TLS and OAuth (MQTT.org), won't save you if you configure the broker with no authentication. The protocol isn't the problem; the implementation is.

How to Actually Troubleshoot Like a Practitioner

First, check the physical layer. Is the cable plugged in? Are the link lights on? Then check IP configuration. Ping the device. If it responds, check the protocol settings—baud rate, parity, register mapping. Finally, check security settings: are you using default passwords? Is encryption enabled?

We need to adopt the mindset of "secure by demand." CISA's guidance warns that threat actors exploit weak authentication and insecure settings (CISA). That's not a protocol flaw; that's a configuration flaw.

What I'd Actually Do

Stop chasing the new protocol. Instead, do a configuration audit of your existing plant floor. Map every device, every IP, every open port. Change default credentials. Segment your network. If you must modernize, use OPC UA or MQTT as a gateway layer, not as a replacement.

And above all, train your team. The ISA/IEC 62443 standards define requirements for asset owners, integrators, and suppliers (ISA/IEC 62443). We all have a role. The next time your network hiccups, don't blame Modbus. Check your own work first.

Sources

• OPC Foundation - https://opcfoundation.org/
• Maximize Market Research - https://www.maximizemarketresearch.com/
• ISA/IEC 62443 - https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
• MQTT.org - https://mqtt.org/
• CISA Industrial Control Systems - https://www.cisa.gov/topics/industrial-control-systems