Securing legacy machines and older lines: a pragmatic approach

Most industrial cybersecurity problems don't involve new plants — they involve lines that have been running for ten or twenty years. PLCs that still work perfectly but can no longer be updated, industrial PCs on Windows XP or Windows 7 tied to control software that runs on nothing else, protocols with no authentication, flat networks where everything can reach everything. These machines are producing, and nobody can take them offline for a week to rebuild them.

The realistic starting point is this: on an existing line, you don't secure the machine by replacing it. In most cases you can't — because of cost, operational continuity, or because the change would void warranties and validations. Instead you work on what surrounds it, with controls that reduce risk without touching the process logic. It's a compromise, and it should be stated plainly: a well-isolated old machine is more defensible than a modern one left on a flat network.

First: know what's there

You can't protect what you don't know. The first step — unglamorous but decisive — is a real inventory: which controllers, which firmware versions, which PCs and operating systems, which protocols, who connects and from where, which network flows actually exist. On existing plants the documentation is almost always incomplete or outdated, and what you find in the field doesn't match the drawing. Much of this inventory can be rebuilt passively, by listening to network traffic rather than actively querying devices — precisely because an old PLC can lock up when hit with aggressive scans.

Isolate, don't expose

The most effective and cheapest control on an old line is segmentation. Enclose the machine in a defined network zone, with an industrial firewall that only allows the flows that are genuinely needed (communication with the SCADA, the link to the HMI) and blocks everything else. A PLC that can no longer be authenticated or encrypted becomes far harder to attack if it simply can't be reached from where it isn't needed. This is the approach covered in detail in the article on OT network segmentation.

Govern access — maintenance access above all

On dated machines the most critical access is the OEM's or the external maintainer's. It often started as improvised remote support: a modem, an always-on VPN, shared credentials. It needs to be brought back to governed access: enabled on request, logged, with individual identities and limited to the relevant zone only. This doesn't require exotic technology — it requires an orderly access architecture, as discussed in the article on secure remote access to plants. The same reasoning applies to USB drives, which on these lines remain one of the main infection vectors.

Reduce the attack surface on the control PC

When the industrial PC can't be replaced, you can still restrict what runs on it: disable unnecessary services and ports, block execution of unexpected software through application whitelisting, disable USB ports that aren't needed, separate the working account from administrative privileges. An unsupported operating system remains a risk, but an unsupported system that is network-isolated and locked to a known list of programs is a different thing from an unsupported system left wide open.

Being able to roll back

On an old machine, recovery is part of security. You need verified backups of the PLC program, the industrial PC image and the configurations, kept offline and tested at least once. In practice a backup almost always exists, but it's often old, incomplete or never tested: when you actually need it, you don't know whether it works. A recovery you've rehearsed is worth far more than a backup you only assume is good.

Mistakes to avoid

• Treating security as a one-off project: the configuration must be maintained over time, not frozen at commissioning.
• Actively scanning networks with dated PLCs without precautions: you risk taking the line down.
• Confusing "compliant with a standard" with "secure": compliance is a useful milestone, not an operational guarantee.
• Postponing everything until the machine is replaced. Replacement may come, maybe, in years; the exposure is now.

How we can help

Concrete work on an existing machine base starts with a field assessment — inventory, flow mapping, identifying the access paths that actually exist — and continues with targeted interventions by priority: segmentation, tidying up maintenance access, hardening the workstations, backup and recovery planning. Interventions designed to coexist with production, without unnecessary downtime and without touching the process logic where it isn't essential.

Useful references

• ISA/IEC 62443 — series of standards for industrial automation and control systems security
• NIST SP 800-82 Rev. 3 — Guide to Operational Technology (OT) Security
• CISA — Industrial Control Systems
• ENISA — SCADA and industrial control systems