Securing ICS/SCADA Systems in 2026

Industrial control system security is not a subset of IT security. The threat model is different, the priorities are different, and, most importantly, the cost of getting it wrong is different. Reinstalling an office workstation is an inconvenience. Halting a production line costs money by the hour, and a security tool that intervenes incorrectly can put people at risk.

This article is about building a security programme in an industrial environment that works with operations rather than against them.

Why the IT toolkit does not transfer

IT security follows the classic CIA priority order: confidentiality, integrity, availability. In OT the order is reversed, availability and human safety come first, confidentiality last. Several practical consequences follow.

You cannot patch on a schedule. Updating PLC firmware requires planned downtime, and there may be one or two windows a year. Many devices are out of vendor support, or an update would invalidate the system's certification. Vulnerability management here is not about patching, it is about compensating controls.

You cannot install agents everywhere. You do not deploy a modern EDR onto an HMI running Windows XP. Many controllers simply will not execute third-party code.

Active scanning can cause damage. A standard network vulnerability scanner is capable of knocking over an older PLC purely by sending it unexpected packets. OT discovery must be passive by default: the asset inventory is built from traffic mirroring and protocol analysis.

The protocols have no authentication. Modbus, DNP3, S7comm and their peers were designed for physically isolated networks. They carry no authentication or encryption, whoever reaches the network can issue commands.

Always start with the asset inventory

You cannot protect what you do not know about. The overwhelming majority of OT projects stall because it turns out nobody knows exactly what is on the network.

A usable inventory is not a device list. For each item it should record:

• vendor, model, firmware version (this drives vulnerability matching),
• network location, IP/MAC, protocols spoken,
• communication partners, who talks to whom in normal operation,
• the associated process and its criticality,
• support status and the responsible supplier.

The communication matrix is the most valuable part: it reveals that a controller is directly reachable from the office network, or that a maintenance laptop regularly connects without a VPN.

Build zones and conduits (IEC 62443)

IEC 62443 is the reference standard for OT security. Its most useful element is the zone-and-conduit model: you divide the system into groups with equivalent security requirements (zones) and define precisely what traffic may cross between them (conduits).

The Purdue model layers are a good starting point:

Level	Contents	Typical zone boundary
4–5	Enterprise IT, ERP	This is IT territory
3.5	Industrial DMZ	The most important dividing line
3	Site operations, historian, MES
2	SCADA, HMI
1	PLC, RTU, controllers
0	Sensors, actuators

In practice the single highest-yield measure is building an industrial DMZ between levels 3 and 4. No traffic should pass directly between the office network and the plant: all data exchange should go through intermediate systems in the DMZ (replicated historian, jump server, file transfer).

Related to this is Security Level (SL) determination: for each zone you decide what capability of adversary it must withstand. Not every zone needs to be SL 3, the classification is risk-proportionate, and this is what makes the programme affordable.

Eliminate the flat, unsegmented network

In many plants the entire production floor is a single broadcast domain. That means one infected maintenance laptop can reach every controller.

Segmentation, in order of return:

1. IT/OT separation with an industrial DMZ, this delivers the largest risk reduction.
2. Cell and line separation, so that compromise of one line does not spread to another.
3. Micro-segmentation of critical assets, safety systems (SIS), key controllers.
4. Channelling remote access: every external entry through a single, logged, MFA-protected point.

Remote access deserves particular attention: supplier maintenance channels are the most common entry points. If a machine builder connects with their own VPN directly to their equipment, that is an uncontrolled door onto your network.

Monitor passively, but continuously

Once you have the communication matrix, it becomes a baseline. OT traffic is remarkably predictable compared with IT: the same devices talk to the same peers at the same cadence. This means anomaly detection works far better here than in IT environments.

Worth watching:

• a new device appearing on the network,
• a new connection between two devices that never previously communicated,
• engineering commands (program download, mode change, firmware write), these are rare and always suspicious without a corresponding change ticket,
• protocol violations and traffic volume deviations.

Plan for incidents, the OT way

An IT incident response plan cannot be used unmodified. In OT:

• Isolation is not the default response. Disconnecting a segment may stop the process; the decision must be made jointly with operations against pre-defined criteria.
• Human safety overrides everything. Safety instrumented systems are not touched in the name of incident response.
• Recovery requires offline backups of PLC programs and HMI projects. These must be tested, in many organisations the "backup" is a years-old file on an engineer's laptop.
• Practise with tabletop exercises. A half-yearly tabletop involving operations management and IT is worth more than any document.

A realistic roadmap

An OT security programme does not get built in six weeks. A workable sequence:

Months 0–3: passive asset discovery, communication matrix, risk assessment, quick wins (default passwords, unnecessary services, undocumented remote access).

Months 3–9: industrial DMZ, IT/OT separation, channelled remote access, continuous monitoring.

Months 9–18: cell-level segmentation, asset hardening, backup and restore programme, OT-specific incident response plan and exercises.

Ongoing: vulnerability management with compensating controls, supplier security, measurement and review.

The order is deliberate: each step builds on the last, and each delivers measurable risk reduction on its own. If you start with segmentation and no asset inventory, you will be writing firewall rules blind, and after the first bad rule, operations will not let you near the network again.

If you want to assess where your OT environment stands, our OT risk assessment follows exactly this logic, and our network segmentation service covers implementation of the zone model.