“Our critical systems run on software that can't be patched or upgraded yet.”
Industrial systems often outlive vendor support by years. When patching or upgrading isn't possible yet, risk can still be reduced and documented.
Control systems commonly run for decades.
Unsupported systems accumulate unpatched vulnerabilities.
Regulators expect a documented rationale and compensating measures.
Replacement must be budgeted and aligned with major outages.
A sequence that can be adapted to your environment and scope.
List unsupported operating systems, firmware and applications.
Rate exposure and consequence for each legacy system.
Tighten segmentation and restrict access around them.
Apply allowlisting, hardening and monitoring where possible.
Schedule migration with the next suitable outage.
An HMI server runs an operating system that left support years ago. It is moved into its own zone with only the required flows allowed, application allowlisting is applied and its replacement is added to the next turnaround scope.
A measure that reduces risk when the normal fix is not possible, such as isolating the system, restricting access, application allowlisting or additional monitoring.
From the blog
Regulation7 min
National NIS2 laws are now being enforced. Here is what energy, water, transport and manufacturing operators should be able to show for their OT environments.
Read the article
Regulation6 min
Manufacturers must now report actively exploited vulnerabilities and severe incidents. Asset owners should expect more advisories, and suppliers need a working process.
Read the article
Architecture8 min
Segmentation diagrams often look perfect and behave very differently. A practical method for zones and conduits that match how your site really works.
Read the articleDescribe where you are today and we'll suggest a practical way forward.