OT Cyber Security for Plants: A Practical IEC 62443 Starting Point

Why OT security is different from IT security

IT security prioritises confidentiality; OT prioritises availability and safety. You cannot simply patch and reboot a controller in the middle of a production run, and many OT devices run for 15 to 25 years on software that vendors no longer update. Security measures in OT must therefore be designed around uptime, change control and the physical process.

What is IEC 62443?

IEC 62443 is the international series of standards for security of industrial automation and control systems. It covers the whole chain: asset owners, system integrators and product suppliers. It introduces useful concepts such as security levels (SL 1 to SL 4), which describe the strength of protection against increasingly capable attackers, and the division of a plant into zones connected by conduits.

Components can be certified too. For example, the Westermo Viper series includes routing switches certified to IEC 62443-4-2 SL2, which gives asset owners evidence that a product meets component-level security requirements.

Step 1: Know what you have

You cannot protect what you cannot see. Build an inventory of controllers, HMIs, switches, drives, engineering laptops and remote-access paths, including firmware versions and network connections. Many plants discover forgotten devices, unmanaged switches and undocumented modem links during this exercise, and those are exactly where incidents begin.

Step 2: Segment the network into zones

Segmentation is the single most effective measure for most plants. Group assets into zones according to function and criticality, such as safety systems, control cells, supervisory systems and the plant DMZ, and control all traffic between them through firewalls or routers with explicit rules. This follows the layered thinking of the Purdue model: do not allow direct connections from the corporate network to controllers.

Segmentation depends on the right hardware. Managed switches with VLANs and routers with firewall functions are the building blocks, which we cover in our industrial Ethernet switch guide. Browse our Westermo networking range for industrial switches, routers and gateways.

Step 3: Secure remote access

Remote access for vendors and engineers is convenient and a common entry point. Use a single, controlled gateway with multi-factor authentication, individual accounts, session logging and time-limited approvals. Avoid shared passwords, direct internet exposure of PLCs and always-on modems.

Step 4: Harden devices and manage change

• Change default passwords and disable unused services and ports on controllers, HMIs and switches.
• Apply role-based access so operators cannot change engineering settings.
• Keep tested backups of PLC programs, HMI projects and switch configurations, stored offline.
• Establish a patch and firmware process with testing windows aligned to maintenance shutdowns.
• Control removable media and engineering laptops, a frequent source of malware.

Step 5: Monitor and prepare to respond

Collect logs and network alerts, and know what normal looks like so unusual traffic stands out. Write an incident response plan that includes plant operations, not only IT, and rehearse it. Regular maintenance and support is a natural moment to review backups, firmware and configurations.

The Purdue model: where do your assets sit?

The Purdue model (from the ISA-95 standard) is a useful map for segmentation. Level 0 is the physical process with sensors and actuators; level 1 is basic control such as PLCs and RTUs; level 2 is supervisory control with HMIs and SCADA; level 3 covers site operations such as historians and manufacturing execution; levels 4 and 5 are the enterprise IT networks. Between the plant and enterprise sits an industrial demilitarised zone (DMZ) where data is exchanged safely.

Mapping your assets to these levels shows where traffic should and should not flow, and gives you the basis for your firewall rules and network design.

Common attack paths into OT networks

• Phishing or malware on the corporate network that reaches the plant through a flat network.
• Poorly secured remote access, such as exposed remote desktop or shared vendor accounts.
• Infected USB drives or engineering laptops connected directly to controllers.
• Default or weak passwords on PLCs, HMIs, switches and routers.
• Unpatched, internet-exposed devices and forgotten modems or cellular gateways.

A practical 90-day starter plan

You do not need to do everything at once. In the first 30 days, build the asset inventory, change default credentials and back up all configurations. In days 30 to 60, place firewalls at the boundary between IT and OT and close unnecessary remote access paths. In days 60 to 90, segment the most critical zones, set up logging and alerts, and run a tabletop incident exercise. Then use the results to plan a longer roadmap aligned with IEC 62443.

How BEC can help

BEC provides OT cyber security services alongside control systems engineering, so security is designed into automation projects rather than added afterwards. We also offer training and certification so that your own people understand the risks. To discuss an assessment of your plant, contact our team.

Frequently asked questions

Is IEC 62443 mandatory?

It is a voluntary standard in most jurisdictions, but regulators, insurers and large asset owners increasingly reference it in tenders and requirements. Following it is also a practical way to structure an OT security programme.

Can we just air-gap our plant?

True air gaps are rare in modern plants because of remote support, data collection and software updates. Even isolated networks can be compromised through removable media or laptops, so layered defences remain necessary.

Where should a small plant start?

Start with an asset inventory, change default passwords, back up all configurations, and place a firewall between the plant and the corporate or internet network. Then add segmentation and controlled remote access.