OT protection platform maintenance
We keep your installed OT protection devices up to date. Maintenance runs under a custom agreement, within a scope agreed with you.
Why it needs maintenance
Protection changes as the plant changes
The protection configured at installation reflects the environment as it was then. These changes are why it needs regular maintenance.
Control software gets updated
Allowlisting endpoint protection lets only what is on the list run; everything else is blocked by default. When the equipment supplier updates the control software, the allowlist has to be updated too.
New vulnerabilities appear
Devices that cannot be patched are protected by an industrial IPS installed inline on the network, which applies virtual patches: it recognizes traffic aimed at a vulnerability and blocks it. A PLC's firmware can be updated at most once or twice a year, during a planned shutdown. Until then, the IPS rule set filters out traffic targeting new vulnerabilities, so it has to be kept up to date as well.
A new device joins the plant
A new HMI, engineering workstation, or controller does not come under protection by itself. A common finding in our assessments is a device left over from a project years earlier that nobody manages.
Deliverables
What the maintenance includes
items
- Updates and rule set maintenance
- Adding new OT devices to the protection
- Quarterly review and report
Related
What the maintenance builds on
Maintenance works with devices that are already installed. The services below install them or provide the asset inventory behind them; the article explains how endpoint protection works.
OT protection project
Installing network and endpoint OT protection devices at critical points, based on the risks identified in the assessment.
OT endpoint protection
Industrial endpoint protection for old HMIs, engineering workstations, and industrial PCs that cannot be updated or are cut off from the internet.
OT security assessment
An OT asset inventory and communication map: it shows what is on the OT network and what talks to what.
Article: OT endpoint protection: how it differs from IT tools
Allowlisting, virtual patching, and knowledge of industrial protocols, with practical points for deployment.
Frequently asked questions
The questions we hear most
Do you also monitor alerts?
No, platform maintenance does not include alert monitoring. So it is worth agreeing in advance who reviews the alerts, who approves new items, and what happens if the protection blocks something during a night shift. For incidents, the OT incident response protocol provides the procedure.
Which devices does the maintenance cover?
Installed network and endpoint OT protection devices. Our designs are vendor-independent; for OT-specific needs we work with TXOne products (EdgeIPS, EdgeFire, Stellar, Portable Inspector). The set of maintained devices is defined for each client. If someone else installed your OT protection devices, we can take over their maintenance after an assessment.
Does an update or rule change mean downtime?
We schedule every intervention together with the client. If there is a spare HMI with the same configuration, it is worth testing the change on it first, before it goes onto a production machine.
