Your operational technology isn't as isolated as you think. When the UK's National Cyber Security Centre issues the same warning three times in five months, it's not just an advisory anymore. The problem is real: 82% of analyzed cyber-physical system attacks involved VNC clients accessing exposed assets, and 66% compromised HMIs or SCADA systems through direct internet connections.
If you're responsible for OT security, here's how to systematically identify and secure internet-exposed devices before they become your next incident.
The Problem: False Assumptions About Air Gaps
The most dangerous phrase in industrial cybersecurity is "that system isn't connected to the internet because we have an air gap." Reality check: your supposedly isolated system is likely connected through a forgotten vendor remote access portal, a misconfigured firewall rule, or an undocumented cellular gateway someone installed to pull production data.
Legacy equipment compounds this visibility gap. When 88% of cyber-physical systems fail to transmit accurate product codes and 76% use product names that don't match vendor records, your security tools can see an asset without having enough information to assess its risk. That 30-year-old PLC controlling your production line? It speaks protocols your IT scanners can't safely query, and it probably fell off your asset inventory years ago.
You need complete visibility before you can secure anything.
What You Need Before Starting
Before you begin scanning and segmenting, gather these resources:
- Documentation access: Pull your network diagrams, firewall rules, vendor maintenance contracts, and any existing OT asset inventories. They're incomplete, but they're your starting point.
- Passive network monitoring capability: Active scanning can crash legacy OT devices. You need tools that can observe network traffic without sending packets. Deploy network TAPs or SPAN ports at key OT/IT boundaries.
- Stakeholder alignment: Schedule downtime windows with operations teams. You'll need controlled access to verify devices, and you can't do this during production runs.
- External scanning baseline: Run Shodan or similar internet scanning tools against your own public IP ranges. This shows you what attackers already see.
- Authentication inventory: List every remote access method currently in use -- VPNs, vendor portals, cellular gateways, remote desktop connections. Include the authentication mechanisms for each.
Step-by-Step Implementation
Phase 1: Establish Complete Asset Visibility (Weeks 1-3)
Deploy passive monitoring at every network boundary between IT and OT, and between OT zones. Configure your monitoring to capture:
- MAC addresses and IP assignments
- Protocol conversations (Modbus, DNP3, BACnet, OPC)
- Connection patterns and frequency
- Firmware versions and device identifiers
Run this passively for at least two weeks to catch devices that only communicate during specific production cycles or maintenance windows.
Cross-reference passive discovery against your external scan results. Any device visible from the internet that doesn't appear in your internal monitoring is either misconfigured or bypassing your network architecture entirely.
For legacy devices that don't transmit useful identification data, manually document them during your next maintenance window. Record manufacturer, model, serial number, firmware version, and physical location. Yes, this requires walking the plant floor with a clipboard.
Phase 2: Classify Internet Exposure Risk (Week 4)
Build a risk matrix for every discovered asset:
- Direct internet exposure: Device has a public IP or port forwarding rule pointing to it. Immediate remediation required.
- Indirect exposure via jump host: Accessible through a VPN or bastion host. Assess authentication strength and logging.
- Vendor remote access: Third-party maintenance portals or cellular gateways. Verify these connections are documented and controlled.
- No documented internet path: Verify this assumption by checking for cellular modems, satellite links, or contractor-installed access points.
Flag any device using default credentials, unencrypted protocols (Telnet, HTTP, VNC without encryption), or running end-of-life firmware.
Phase 3: Eliminate Direct Exposure (Weeks 5-8)
Work through your direct exposure list systematically:
Remove public IP assignments from PLCs, HMIs, and SCADA systems. If remote access is required, route it through a secure gateway with multi-factor authentication and session logging.
For cellular-connected devices (common in water treatment and remote sites), replace direct SIM card connections with connections that terminate at a managed VPN concentrator. Configure the concentrator to enforce authentication, log all sessions, and restrict access to specific source IPs.
Disable unnecessary services on edge devices. If a gateway doesn't need VNC, SSH, or web management interfaces exposed, turn them off at the firmware level.
Replace protocols where possible: Modbus TCP instead of Modbus RTU over serial-to-ethernet converters, secure OPC UA instead of classic OPC DCOM, encrypted MQTT for IoT sensor data.
Phase 4: Implement Network Segmentation (Weeks 9-12)
Create distinct zones with firewall enforcement:
- Level 0-1 (Process control): PLCs, RTUs, field devices. No direct internet connectivity.
- Level 2 (Supervisory): HMIs, SCADA servers, historians. Controlled access from Level 3 only.
- Level 3 (Operations management): MES, asset management, data aggregation. This is your DMZ between OT and IT.
- Level 4-5 (Enterprise): ERP, business systems, internet access.
Configure firewalls with default-deny rules. Explicitly whitelist required protocols and ports between zones. Log denied connection attempts -- they reveal both misconfigurations and reconnaissance activity.
For vendor access, create a separate VLAN with time-limited access. Require vendors to authenticate through your VPN, restrict them to specific devices, and log their entire session.
Phase 5: Harden Remote Access (Ongoing)
Replace password-based authentication with certificate-based or hardware token authentication for all remote access to OT systems.
Implement Just-in-Time Access for maintenance windows: accounts are disabled by default and only activated for approved time windows.
Configure your VPN to enforce device posture checks before granting access. Require updated antivirus, OS patches, and endpoint detection on any device connecting to OT networks.
Log every remote session with full packet capture. Store these logs outside the OT network so they survive a compromise.
Validation: How to Verify It Works
Run monthly external scans against your public IP ranges. You should see zero OT devices, zero default web interfaces, and zero exposed industrial protocols.
Test your segmentation by attempting cross-zone connections that should be blocked. Document what gets through and fix the firewall rules.
Review remote access logs weekly. Look for connections from unexpected IPs, failed authentication attempts, or sessions outside normal maintenance windows.
Schedule quarterly tabletop exercises where you simulate a compromised vendor account or exposed device. Walk through your detection and response process.
Maintenance: Ongoing Tasks
- Weekly: Review remote access logs and failed authentication attempts.
- Monthly: Run external vulnerability scans and compare against your asset inventory.
- Quarterly: Update your asset inventory during maintenance windows. New devices appear, old ones get replaced, and firmware versions change.
- Annually: Re-verify that your supposedly air-gapped systems remain isolated. Test every vendor access path for unnecessary exposure.
When you install new edge devices -- 5G gateways, robotics controllers, IoT sensors -- run them through this same process before production deployment. They introduce new attack surfaces if misconfigured.
The NCSC's repeated warnings signal a shift from advisory to mandate. Organizations that wait for regulatory enforcement will find themselves implementing these controls under audit pressure instead of on their own timeline. Start your visibility assessment now, before your next compliance review forces the conversation.
