How do we secure legacy SCADA systems during IT and OT convergence without causing downtime?

All answers to this question.

The most effective way to handle this is by implementing the "Identify" and "Protect" functions of the NIST CSF through network segmentation rather than direct patching. Since legacy PLCs often cannot handle modern security agents, you should use a Purdue Model architecture to create DMZs between your plant floor and corporate network. This "virtual patching" via industrial firewalls allows you to inspect traffic without touching the sensitive legacy hardware. We successfully reduced our attack surface by 60% using this method in 2023 without a single minute of unplanned downtime.

   Answered 2025-06-14 by Deborah Miller

Have you considered using unidirectional gateways (data diodes) to ensure that data only flows out from the SCADA to the analytics engine? This physically prevents external threats from reaching the controllers.

   Answered 2025-07-20 by Mark Thompson

• Mark, that is a solid suggestion for data integrity, but how do we manage remote maintenance if the connection is strictly one-way? We often need vendor support to access the PLCs for troubleshooting.

     Commented 2025-07-22 by Steven Rogers

You should focus on deep packet inspection (DPI) for industrial protocols like Modbus or Profinet. This identifies anomalies in the traffic before they reach the legacy units.

   Answered 2025-08-10 by Michael Higgins

• I agree with Michael. DPI is essential because it understands the specific language of OT assets, which standard IT firewalls usually ignore.

     Commented 2025-08-15 by Sarah Jenkins