Security Controls and Defense in Depth
Domain 4 tests layered technical and administrative controls suitable for OT, including access control, allowlisting, remote access, backups, patching, and physical protection.
Core rules
- Apply least privilege and role-based access. Separate engineering workstation accounts from domain accounts; avoid shared passwords.
- Application allowlisting often fits legacy HMIs better than signature antivirus, which may be unsupported or disruptive.
- Secure remote access uses a DMZ jump host, MFA, session recording, time-bound accounts, and vendor-specific credentials.
- Backups must be offline or isolated, tested, and include PLC/HMI configurations. Know the restore procedure before an incident.
- Patching is risk-based, staged, and reversible; use compensating controls when a patch cannot be applied.
- Physical controls and USB restrictions matter because removable media is a common OT infection path.
Worked example
A Windows 7 HMI cannot be patched. Reasoning: isolate it in a zone, restrict USB use, allowlist required applications, limit network access to its PLC and historian, and monitor for anomalous SMB traffic. Plan an upgrade. These compensations reduce exposure but do not equal patching.
Traps
Using a domain admin account on an HMI; relying only on antivirus; applying IT password rotation to service accounts without testing; blocking all USB ports without an operational workaround; assuming a vendor VPN is automatically secure.