To cope with geopolitical conflicts, criminal enterprises and other malicious players launching cyber-threats, system integrator Vertech advises looking at which equipment is aging out of support, check how easily outside connections can reach control systems, and gauge readiness and ability to respond if a critical part suddenly becomes unavailable. Located in Phoenix, Ariz., Vertech is a longtime member of the Control System Integrators Association (CSIA).

“As a network engineer and system integrator working with industrial and SCADA environments, I’ve seen customers struggle with balancing stronger cybersecurity practices with the need to keep critical operations reliable,” says Crest Awanis, network engineer at Vertech. “One common example is moving from traditionally flat or physically separated networks to more segmented architectures using VLANs, firewalls, and security zones. The challenge is often determining exactly what devices need to communicate and tightening security without disrupting operations.

“I’ve also seen challenges with legacy industrial equipment that weren’t designed with today’s cybersecurity standards in mind. My biggest advice is to start with good network documentation and a clear understanding of required communication paths. Security improvements don’t have to happen all at once. Gradually improving segmentation, access control, monitoring, and documentation can significantly strengthen an OT environment while minimizing operational risk.”

Authenticate and segment

Michaela Pawlowski, senior network engineer at Vertech, adds, “Our goal is to secure industrial control system (ICS) networks without limiting the access people and systems need to perform their work effectively. Some key starting points include using named user accounts instead of shared logins, enforcing strong passwords, removing or changing default credentials, applying the principle of least privilege, and enabling multifactor authentication wherever practical. Network segmentation is equally important. It enables the controls network to communicate with business and other systems when necessary while minimizing unnecessary pathways to critical equipment.”

Effective cybersecurity also requires a clear understanding of what’s connected to the network, along with controls for remote access, vulnerability and firmware management, reliable backups, and regular reviews of user access, according to Pawlowski. “Vertech’s network discovery services can help establish this visibility by baselining existing environments, identifying potential gaps and risks, and providing practical recommendations for improvement,” she adds. “Our managed services team can also help customers maintain visibility and address their industrial networking and cybersecurity needs over time. Every facility is different, and our approach is focused on achieving the right balance between security, reliability, and operations.”

Build on visibility

Once networks are segmented and staffers are trained, cybersecurity efforts enter stages where they go back, and “lather, rinse, repeat” to improve their data gathering and protections even more.

Get your subscription to Control's tri-weekly newsletter.

“Start with visibility because every control that follows depends on it. Build an inventory of every device on the network, including PLCs, HMIs, historians, engineering workstations, switches and anything else with a network connection,” says Nick Arlinghaus, system administrator at Vertech. “Capture enough detail to be useful, such as make, model, firmware, protocols spoken and which part of the process it touches. Pair that with an inventory of the people and accounts that touch those devices. Who needs access to what? What role are they filling—engineer, operator, contractor, manager? And what level of access does that role actually require—read-only visibility, configuration rights, or the ability to change setpoints?”

Once both inventories exist on paper, Arlinghaus suggests building a security policy around them. “Together, they’ll tell you which devices should be talking to which, and which users should be able to reach them,” he explains. “That documented baseline is what you enforce with tools like network firewalls and user directories. Used well, these do double duty: they keep unauthorized access out, and they make day-to-day administration of the plant far more manageable than a flat network with shared passwords ever could.”

Get physical outside and inside

While network security is essential in ICS environments, Arlinghaus adds that physical security can't be neglected either.

“This matters most at the lowest device level, where many field components simply can't defend themselves. A passive sensor or an analog transmitter has no firmware to harden, no credentials to set, and no way to tell a legitimate signal from a manipulated one,” says Arlinghaus. “Anyone who can reach the wiring can spoof the reading, and the controller upstream will act on it as though nothing were wrong. For those devices, the perimeter isn't a firewall rule, it's a locked door. This starts with controlling who can walk into the plant at all. Badge or RFID readers at building entrances and process areas, backed by visitor escort procedures and logged access, keep unauthorized people out of spaces they shouldn't be in.

“From there, work inward: keep control cabinets, panels and remote instrument enclosures locked, use tamper-evident seals, protect exposed cable runs in conduit, and secure unstaffed remote sites like pump stations and substations that often see less scrutiny than the main plant. Pair those controls with detection so a breach is noticed rather than discovered weeks later during a routine inspection: cameras, door alarms, and cabinet intrusion switches.”