Stop Treating OT Like IT: A Field Guide to Securing Your Plant Network

Who This Is For

You're the person who gets called when the production line stops, or the one who has to explain to management why the OT network can't just be "locked down like the office." This guide is for you — the controls engineer, the plant IT guy, or the consultant who's been handed a brownfield mess and told to make it secure without stopping production.

Here's the contrarian take: the best thing you can do for OT security isn't buying a fancy firewall or deploying an AI-based anomaly detector. It's to stop treating your industrial network like an IT network. The ISA/IEC 62443 series exists because OT security is fundamentally different — it bridges the gap between operations technology and IT, and between process safety and cybersecurity (ISA/IEC 62443). The standard has been recognized by the UN and is a horizontal standard in IEC, with use cases in more than 20 industries (ISA/IEC 62443). That's not a suggestion; it's a benchmark.

So let's walk through the practical steps, in the order I'd take them. This isn't theory. It's what I'd do if I had your plant, your legacy PLCs, and your production deadlines.

Step 1: Map Your Network Like You're Planning a Heist

Before you can secure anything, you need to know what's actually out there. Most brownfield plants have a spaghetti of serial Modbus lines, a few EtherNet/IP scanners, some PROFINET controllers, and maybe an OPC UA server feeding data to the MES. The Modbus protocol, developed in the late 1970s, uses a master-slave register-based model and supports both serial (RTU) and Ethernet (TCP) transport (OPC Foundation). That's not a security feature; it's a vulnerability if left exposed.

So, walk the plant floor. Open every cabinet. Trace every cable. Use a network scanner (carefully, in read-only mode). Create a spreadsheet with every device, its IP address, its firmware version, and which protocol it speaks. You'll be amazed at what you find — a forgotten sensor with a default password, a PLC with an open Modbus port that's been there since 2005.

Here's a concrete example: At one plant I worked with, we found a legacy SCADA system running on Windows XP, connected directly to the corporate network via a switch that had been installed for a temporary demo three years prior. That single switch was the gateway for a ransomware attack that could have halted production for days. The fix wasn't a new firewall; it was disconnecting that switch and putting the SCADA behind a proper OT DMZ.

Step 2: Segment Like Your Production Depends on It (Because It Does)

Once you have a map, you need to create zones and conduits. That's the core of ISA/IEC 62443. The standard defines zones as groups of assets that share common security requirements, and conduits as the communication paths between them. You don't need to be a cybersecurity expert to do this — just follow the principle of least privilege.

Start by separating your OT network from the IT network. That's non-negotiable. If you have an OPC UA server, it should sit in a DMZ, not on the plant floor. OPC UA is vendor-neutral and platform-independent, with built-in encryption and authentication, and it serves as the backbone for IIoT and IT/OT integration (OPC Foundation). But even OPC UA can't protect you if the server is exposed to the internet.

Within the OT network, segment further by process area or risk level. For example, put your motion control systems on their own VLAN, separate from your HMI and historian. EtherNet/IP runs on standard, unmodified Ethernet, supporting IT/OT convergence, with flexible topologies including star, linear, and device level ring (DLR) (ODVA EtherNet/IP). That flexibility is great, but it also means you need to configure your switches correctly.

And don't forget the physical layer. If you have wireless access points for handheld scanners, make sure they're on a separate VLAN with WPA2-Enterprise, not just a shared password. CISA's Secure by Demand guidance for OT warns that threat actors exploit weak authentication, insecure settings, and outdated protocols, and recommends procuring products with open standards, secure configurations, data protection, and strong authentication (CISA Industrial Control Systems). That's exactly what you're doing here.

Step 3: Patch, But Patch Smart

Patching is the one thing that can make or break OT security. But you can't just push updates like you do for Windows servers. Many legacy ICS devices continue to use outdated operating systems and older protocols that lack encryption or authentication (CISA Industrial Control Systems). And a failed patch can take a production line down.

Here's the practical approach: First, inventory all your firmware versions. Then, create a risk-based patch schedule. Priority one: any device that's exposed to the internet or to a network segment that could be compromised. Use CISA's Known Exploited Vulnerabilities (KEV) catalog as your guide — it's the authoritative source of vulnerabilities that have been exploited in the wild, intended as input to vulnerability management prioritization (CISA Industrial Control Systems). If a vulnerability is in the KEV catalog and it affects your OT device, patch it yesterday.

But also consider compensating controls. If you can't patch a legacy PLC, you can at least restrict access to it via a firewall rule. Remember, the goal is to reduce risk, not achieve perfection. And if you're working with a vendor like ABB or Siemens, they often have patch management programs — use them. Siemens, for instance, is one of the leading industrial automation companies, along with ABB, Schneider Electric, and Rockwell Automation (Maximize Market Research). They have a vested interest in keeping their installed base secure.

Step 4: Monitor and Respond — But Don't Overdo It

Once you've mapped, segmented, and patched, you need to know when something goes wrong. But here's the thing: you don't need a $100k SIEM with a 24/7 SOC. You need to start with the basics.

Enable logging on your key devices — PLCs, HMIs, and switches. If you have a firewall between zones, log the traffic that's allowed and denied. Use a simple log server and set up alerts for anomalies. For example, if a PLC that normally talks to one HMI suddenly tries to connect to a database server, that's a red flag.

And here's a warning: what can go wrong is that you'll be overwhelmed by alerts. Too many false positives will cause you to ignore the real ones. So start with a small set of rules based on your network map. Also, consider that many industrial protocols are plaintext. Modbus, for instance, has no encryption or authentication. That means anyone who can sniff your network can read and even send Modbus commands. If you have Modbus devices, make sure they're on an isolated segment and that the traffic to them is monitored.

One thing that actually works well is using the industry's own tools. For example, EtherCAT has distributed clocks for hardware-based synchronization, achieving system jitter significantly below 1 µs (EtherCAT Technology Group). That's a feature for performance, but it also means you can detect timing anomalies that could indicate a cyber intrusion. Similarly, Sercos has a ring configuration where cable breaks are recognized within 25 µs, so data is lost for a maximum of one cycle (Sercos International). That's a resilience feature that can help you detect physical tampering.

What I'd Actually Do

If you take nothing else from this, take this: start with segmentation and inventory. You cannot secure what you don't know about. Then, prioritize patching based on the KEV catalog and exposure. And finally, implement basic monitoring — you don't need AI, you need visibility.

Here's my concrete recommendation: In the next 90 days, do a network discovery, create a zone-and-conduit diagram, and implement one firewall rule that blocks all traffic from the IT network to the OT network except through a designated DMZ. That one rule will eliminate more risk than any other single action. And if you're in an industry like healthcare or energy, remember that CISA publishes ICS advisories noting that exploitation of vulnerabilities can lead to data corruption, exfiltration, or significant physical consequences (CISA Industrial Control Systems). That's not a scare tactic; it's a fact.

Finally, don't try to do this alone. Get training from CISA, which offers ICS training online and in-person in partnership with Idaho National Laboratories (CISA Industrial Control Systems). And consider joining ISA's Global Cybersecurity Alliance, which has more than 50 member companies representing over $1.5 trillion in aggregate revenue (ISA/IEC 62443). You're not in this alone.

Sources

• ISA/IEC 62443 - https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
• CISA Industrial Control Systems - https://www.cisa.gov/topics/industrial-control-systems
• OPC Foundation - https://opcfoundation.org/
• ODVA EtherNet/IP - https://www.odva.org/technology-standards/key-technologies/EtherNet-ip/
• EtherCAT Technology Group - https://www.ethercat.org/en/technology.html
• Sercos International - https://www.sercos.org/technology