What are the Secure Connectivity Principles for Operational Technology?

Examples of the Secure Connectivity Principles for OT in Play

These hypothetical examples show how a manufacturing plant can move from a high-risk setup to the desirable end states.

Scenario A: Remote Vendor Maintenance

A plant may need an external vendor to troubleshoot a specialized machine. But relying on a traditional “always on” VPN can create unnecessary exposure by giving that vendor a direct path into the entire factory network.

Following Principle 2 and Principle 5, the plant removes direct inbound port exposure. Instead, they use a brokered connection hosted in a secure gateway in a separate iDMZ. This helps create a more tightly controlled setup grounded in multiple security principles.

Before the technician logs in, the plant applies Principle 1 by verifying a formal business case to ensure a connection is required. Access is managed through Principle 2 as just-in-time connectivity. 

Once the session begins, the plant enforces Principle 5 and only allows the vendor to only service the specific machine. Throughout the session, the security team maintains full visibility by following Principle 7 to monitor every action quickly to detect any unauthorized behavior.

The result of this multi-layered approach is that security no longer relies on a single password. By requiring phishing-resistant multi-factor authentication (MFA) and granting access only during scheduled maintenance, the plant is protected even if a vendor’s credentials are stolen. 

Scenario B: Helping Protect Legacy Product Lines

A facility relies on an obsolete programmable logic controller (PLC) that’s 15 years old. It works perfectly for production but can no longer receive security updates. This makes it a sitting duck if a hacker enters the network.

Using Principle 6, the plant implements micro-segmentation to contain this risk. They place the PLC in its isolated network zone with a hardware firewall to ensure it is physically and logically separated from the rest of the facility. 

By enforcing Principle 5, the plant applies the rule of least privilege and helps ensure the PLC is only allowed to talk to the specific operator station it needs to function. For constant oversight, the security team follows Principle 7 to log and monitor all traffic entering or leaving this zone, allowing them to spot any unusual communication patterns immediately.

Now, the PLC is segmented so it can only talk to the specific operator station it needs to function. If a different piece of technology gets infected with malware, the infection is then trapped and cannot move laterally to the legacy product line. 

Putting the Secure Connectivity Principles for OT Into Practice 

The Secure Connectivity Principles for OT provide a strategic roadmap. But turning them into action across a complex OT environment requires the right combination of tools, expertise, and ongoing support.

That’s where SecureOT™ solution suite comes in. Our comprehensive solution suite is built for OT environments and helps organizations align with these principles through the following: