OT Security for Brownfield Sites

Ask a plant manager whether their production network is connected to the outside world and the answer is often no. On the wiring diagram, that's true. What breaks the isolation is never a project with a budget and a kick-off: it's the maintenance laptop that goes from machine to machine, the 4G router someone put in a cabinet so a supplier could dial in over a weekend, the VPN a machine builder needs in order to honour its service contract. The air gap is rarely removed. It gets quietly worked around, one exception at a time and the exceptions are what an attacker finds. The three situations below are ones we meet regularly in the field.

Suppose a manufacturer has installed several thousand security gateways in customer facilities around the world. The software generation on a large part of that fleet is reaching end of life, while the maintenance contracts covering those machines run for years beyond it. As a consequence the security horizon and the contractual one no longer match. Two facts make this harder than it looks: Only about a third of the fleet is reachable online at any given moment, and a substantial number of devices report no software version at all. 

Before a single security measure can be planned, the first job is to find out what is actually out there. Inventory comes before security, and the exchange programme then runs site by site rather than as one migration. This includes taking inventory of all machines, control systems, and other critical systems, as well as existing network connections and remote maintenance access points.

The question of who can access which systems and which connections are actually needed is also crucial. Based on this, risks can be assessed and unnecessary or overly broad access privileges can be reduced. Another important step is network segmentation: Instead of operating all systems on a single network, machines and equipment are divided into separate zones. This allows for targeted control of data traffic and prevents an attacker from spreading unimpeded throughout the production network after a successful compromise.

In general, systems pose a security risk as soon as they can no longer be updated. If a manufacturer no longer supports certain operating systems or firmware, even known vulnerabilities cannot be easily patched. 

When modernizing Brownfield environments, ongoing operations must not be interrupted under any circumstances. Proper planning is crucial, as the following example illustrates: A manufacturer operates production facilities on several continents with several hundred older-generation remote access gateways. No one there is under any illusions. These devices merely enable remote access and little else, no segmentation, no traffic inspection, and a throughput that falls short of what the plants need today.

Everyone agrees that a modernization is necessary. So far, however, this has not happened because the modernization project competes for resources with the employees who keep production running, and the timeline keeps getting pushed back to the next quarter. That is the true nature of “brownfield” projects: it is not about a technical problem described in terms of security, but rather a planning problem. What drives the process is a first step that is small enough to fit into the gaps. Instead of replacing all gateways, you start with one line or just one cell.

To ensure that security software for machines can be kept up to date at all times, the machines themselves should not also serve as the hosts for their security functions. It makes more sense to deploy a security gateway as a security layer in front of the existing system.

The Endian 4i security gateways are specifically designed for industrial networks. They feature a range of coordinated security functions, such as a firewall, an intrusion detection/prevention system (IDS/IPS), Layer 7 filtering capabilities, and deep packet inspection (DPI).

Endian offers the 4i Security Gateways in three versions: as hardware, as software, and as a virtual solution. The hardware version can be used to replace older devices. The software and virtualization solutions transform existing industrial PCs (x86) into full-fledged security gateways. This makes it possible to continue using existing hardware.

Once connected, gateways receive security updates centrally through Endian Network, the support and licensing layer of the Endian Secure Digital Platform, so patching a distributed fleet no longer depends on someone travelling to each site. One caveat worth naming: a device that never comes online cannot be patched remotely. That gap is closed with a service window and a contract clause, not with a product.

In remote access scenarios, wide-ranging permissions pose a common security risk. If access is compromised, an attacker may be able to view sensitive data, change configurations, or penetrate other areas of the network. Equally risky is direct access to a system without an intermediate security layer.

An OEM's technicians rely on remote access every working day. Two changes were on the table: a platform upgrade and a move to central identity management. The company deliberately did them in sequence, months apart, and for a reason worth stating plainly: if identity breaks, technicians cannot reach machines, and a service call does not wait for a rollback. The same environment also carries an access configuration chosen more than a decade ago that nobody in the company can explain any more. It works, so nobody touches it. Both halves point the same way — in brownfield, the order of operations is itself a security decision, and you document what people actually use before you change how they get in.

With the Endian Switchboard, companies can assign granular roles and permissions and manage them via a single, centralized dashboard. For example, if an employee leaves the company or changes departments, access rights can be easily adjusted.

Multi-factor authentication (MFA) requires at least one additional form of verification in addition to the password, such as a code from an authenticator app. This grants access on a per-session basis for a single computer, rather than across the entire network. This is precisely what sets it apart from a conventional VPN tunnel: even if login credentials are compromised, an attacker does not automatically gain access to the entire production network.

For particularly critical areas, the Endian Switchboard offers an additional feature: machine operators can grant approval before each access attempt. There is also the option to record remote access sessions. This allows companies to track at any time who accessed a machine, when, and what actions were performed there.

Brownfield modernization isn’t limited to securing network traffic. Another important question is how legacy machines can be connected to new digital applications.

Docker containers can offer a solution here: Applications and microservices are executed directly at the network edge. For brownfield environments, using Docker containers can be a way to utilize the gateway as a link between the existing PLC and new applications.

This allows companies to combine digitalization and security: Existing production systems remain in use while new digital functions are gradually added.