🛡️ CODESYS Academy · Security Track
OT Security Field Kit
A practical, IEC 62443-aligned hardening checklist, the 10 commandments, and a one-page breach runbook. Walk the checklist for any control network — every unchecked box is a door an attacker would happily use.
🧱 1 · Network & segmentation 62443 · ZONES & CONDUITS
No OT asset is reachable from the public internet. Verify on Shodan/Censys; close or firewall anything exposed.FR5 · Restricted data flow
IT and OT are separated by a firewalled DMZ (Purdue L3.5). No flat network, no "temporary" bridge cable.FR5 · Zone boundary protection
Only defined conduits cross zones, with an explicit allow-list of protocols/ports. Deny by default.FR5 · Conduit policy
The Safety Instrumented System is on its own isolated zone, not reachable from the control or business network.FR5 · SIS independence
Wireless and vendor links are segmented and authenticated — no open radio/SCADA links.FR1/FR5
🔐 2 · Remote access & identity 62443 · IAC
Every default password is changed. No "1111", "admin/admin", or vendor defaults anywhere.FR1 · Identification & authentication
Remote access is brokered through a jump host with MFA — no naked RDP/VNC, no shared TeamViewer logins.FR1 · Multi-factor
Least privilege & named accounts. Engineers, vendors and operators each get only what they need; no shared admin.FR2 · Use control
Access is revoked the day someone leaves or a contract ends. (Remember Maroochy Shire.)FR2 · Account management
👁️ 3 · Monitoring & detection 62443 · TRE
OT network traffic is monitored with protocol-aware (Modbus/DNP3/CIP) detection. A PLC speaking new commands is an alert.FR6 · Timely response to events
IT endpoints run EDR tuned to catch living-off-the-land before it pivots toward OT.FR3 · System integrity
Logs are centralised and retained (controllers, jump hosts, firewalls) — and someone actually reads the alerts.FR6 · Audit log
Edge devices (routers/VPN/firewalls) are patched even when the PLC can't be. They're the front door.FR3 · Patch the perimeter
💾 4 · Endpoints & removable media 62443 · SI
USB ports are controlled — disabled, allow-listed, or scanned at a kiosk. The air gap is a vibe, not a control.FR3 · Malicious code protection
Engineering workstations are application allow-listed — only approved software runs.FR3 · Application control
Firmware/project files come from verified sources and are integrity-checked (mind supply-chain CVEs).FR3 · Supply chain
🛟 5 · Safety & resilience 62443 · RA
Offline, tested backups of PLC programs, HMI projects and configs exist — and restores are rehearsed.FR7 · Resource availability
A written incident-response plan exists for OT, not just IT, and key staff know their role.FR6 · IR plan
Manual/safe-state fallback is verified. Operators can run the process if the network is lost (Ukraine grid survived this way).FR7 · Degraded mode
🧑🏭 6 · People & process 62443 · MATURITY
Staff are trained on phishing and OT-specific social engineering. The softest target wears a hard hat.Program maturity
An asset inventory exists — you can't protect what you don't know you have.Foundational hygiene
Change management covers OT: setpoint changes and logic edits are logged and reviewed.FR2 · Use control
📜 The 10 OT-security commandments
- Thou shalt not expose an HMI, PLC or SCADA box to the public internet.
- Thou shalt change the default password.
1111 is an invitation.
- Thou shalt segment IT from OT with a real DMZ — no flat networks.
- Thou shalt put MFA on every remote-access path; kill shared logins.
- Thou shalt patch the edge even when thou canst not patch the PLC.
- Thou shalt keep the Safety System on its own isolated island.
- Thou shalt monitor OT traffic; a new Modbus command is a scream.
- Thou shalt control USB drives. The air gap is a vibe, not a control.
- Thou shalt keep offline, tested backups and an OT incident plan.
- Thou shalt assume breach — minimise what an intruder can do once in.
🚨 "We think we're breached" — first 6 moves
- Don't blindly power-cycle. Rebooting can destroy volatile evidence and may not remove a persistent foothold. Think first.
- Isolate the conduit, not the process. Cut the network path (pull the IT↔OT link) before you risk an unsafe shutdown of live equipment.
- Preserve evidence. Capture logs, network traffic and controller states before changing anything — you'll need them.
- Verify safe state. Confirm the SIS and manual controls can hold the process safely while you respond.
- Activate the IR plan & notify. Engage your incident-response team and report to the relevant authority/CERT (e.g. national CISA-equivalent).
- Recover from trusted backups. Rebuild controllers/workstations from known-good images — never from the possibly-tampered live system.
⚠️ This kit is an awareness and hygiene aid, not a substitute for a formal IEC 62443 risk assessment, your site's safety case, or qualified incident-response support. Adapt every item to your plant's risk and regulatory context.