Free tools Windows power users keep installed
One-click scans. No signup required.
Secure farm machinery and industrial control systems (ICS) by reducing their internet exposure, removing default credentials, applying supported patches, replacing equipment that no longer receives security updates, and putting necessary remote access behind a monitored jump host with multifactor authentication (MFA) where possible. Then monitor traffic, reassess exposed assets as the farm changes, and maintain an incident-response plan that protects physical operations as well as data.
Do not make a security change to a controller, pump, irrigation system, refrigeration unit, or other safety-relevant asset without considering its effect on availability and safe operation. Coordinate disruptive work with qualified OT personnel and the equipment vendor.
As an Amazon Associate I earn from qualifying purchases.
Why farm OT security is different from ordinary IT security
Farm networks increasingly connect tractors, combines, irrigation controllers, grain handling, refrigeration, environmental sensors, building systems, and business applications. Some of those devices use industrial control systems (ICS), supervisory control and data acquisition (SCADA), or industrial internet of things (IIoT) technology. A compromise can therefore affect pumps, gates, conveyors, temperature controls, chemical handling, or other physical processes—not merely expose files.
The security problem is often an ordinary one: a control interface is reachable from the internet, a default password remains active, a remote-access service is misconfigured, or an operating system and application have stopped receiving updates. The operational consequence is unusual because taking a system offline may interrupt watering, feeding, cooling, harvesting, or storage.
#1 Best Overall
- User-friendly NAT functionality simplifies network integration
- Hands-free network access control through automatic whitelisting of locally connected devices
- Integrated security features to ensure device and network safety
- Ultra-compact size and robust industrial design suitable for cabinet installation
- Supports secure boot for checking system integrity
In a joint fact sheet released on May 1, 2024, CISA and partner agencies warned that pro-Russia hacktivist activity had sought access to ICS and small-scale OT in sectors including Food and Agriculture. They described much of the activity as unsophisticated, while noting that insecure or misconfigured environments could still be exposed to techniques with physical consequences. That warning is a reason to close basic access gaps, not a basis for assuming that every farm is under active attack.
The Food and Agriculture Sector-Specific Plan published in 2015 describes the sector’s use of ICS and SCADA and its growing reliance on connected technology. It is useful context, but it is too old to describe today’s threat frequency or the security of a particular farm.
1. Build an inventory of what can be reached
You cannot secure an asset that nobody knows exists. Start with an inventory that covers both equipment and the paths used to administer it. CISA’s Internet Exposure Reduction Guidance, published June 4, 2025, recommends routinely assessing internet-accessible assets; make that review a recurring farm process rather than a one-time project.
Record the equipment and its business purpose
- List controllers, PLCs, RTUs, SCADA servers, HMIs, telemetry gateways, smart drives, robotic equipment, weather and soil systems, cameras, refrigeration and environmental controls, and vendor-managed devices.
- For each item, record the manufacturer, model, firmware or operating-system version, physical location, owner, maintenance contact, and the process it controls.
- Note dependencies such as a controller relying on a local HMI, a cellular gateway, a cloud dashboard, a Windows workstation, or a vendor service.
- Mark whether failure could create a safety hazard, spoil product, interrupt animal care, damage equipment, or merely delay administrative work. This ranking determines how cautiously you make changes.
Map every access path
- Identify public IP addresses, internet-facing web consoles, cloud portals, cellular links, wireless bridges, and remote-desktop services.
- Document vendor connections, service accounts, maintenance laptops, VPN concentrators, and any connection from the farm network to corporate or home-office systems.
- Separate interfaces used for monitoring from those that can issue commands. A dashboard that only displays temperature has a different consequence from an interface that can stop a cooling system.
- Record who can approve, initiate, and terminate remote sessions. Unknown ownership is itself a risk that needs correction.
Use the inventory to prioritize work
Prioritize assets that are directly reachable from the internet, still use factory credentials, have no supported patch path, or can alter a physical process. Review the list after adding equipment, changing an internet provider, moving a controller, granting a new vendor connection, or retiring a system. Keep a dated copy so you can identify changes and prove that an exposure was addressed.
| Asset or connection | Questions to answer | Immediate decision |
|---|---|---|
| Internet-facing controller or HMI | Why is it public, who administers it, and can the interface be removed from the public internet? | Remove direct exposure unless a documented operational need remains. |
| Vendor remote-access link | Is access permanent, which account is used, and can each session be approved and logged? | Move access behind a controlled entry point and limit it to maintenance windows. |
| Legacy workstation or server | Does it receive security updates, and what process depends on it? | Plan replacement if support has ended; use compensating isolation while planning. |
| Cloud-connected sensor or gateway | What data and commands pass through the service, and who controls the account? | Verify account ownership, authentication, update status, and required network paths. |
2. Eliminate default and shared credentials
Change factory usernames and passwords on controllers, gateways, cameras, routers, HMIs, and vendor portals before connecting them to a production network. CISA specifically recommends changing default passwords for exposed industrial systems. Use a separate, strong, unique credential for every device or service that supports it; do not reuse the password for email, accounting, or a personal account.
Rank #2
- Great Variety of Sizes: 32 Pcs of the most commonly used 15 sizes assorted rubber grommet assortment kit.With retractable box cutter and velcro straps
- High Quality: Rubber washers are made of flexible and durable rubber material, they are of good electric resistance capability.
- Easy To Use: Wire grommets are quicker and easier to install since they can be placed on one side only.
- Wide Range of Applications: Very useful for auto and other projects where wiring cable needs to be run through metal or plastic openings.
- Packaging Includes:2-3/8''Drill Hole(2 Pcs),2''Drill Hole(2 Pcs)(2 Pcs),1-9/16''Drill Hole(2 Pcs),1-3/8''Drill Hole(2 Pcs),1-3/16''Drill Hole(2 Pcs),1''Drill Hole(2 Pcs),7/8''Drill Hole(2 Pcs),2-3/8''Drill Hole(2 Pcs),2''Drill Hole(2 Pcs),1-9/16''Drill Hole(2 Pcs),1-3/8''Drill Hole(2 Pcs),1-3/16''Drill Hole(2 Pcs),1''Drill Hole(2 Pcs),7/8''Drill Hole(2 Pcs),13/16''Drill Hole(2 Pcs).With retractable box cutter and velcro straps
Make account ownership explicit
- Create named administrator accounts so actions can be tied to a person. Reserve a separate, tightly controlled emergency account for recovery rather than using one shared administrator login every day.
- Remove former employees, contractors, and obsolete vendor accounts. Review service accounts and document what each one needs to do.
- Store credentials in an approved password manager or another access-controlled system. Do not leave passwords in a maintenance notebook, an HMI label, or an unencrypted spreadsheet.
- Where a device cannot support individual accounts, restrict the device’s network reach, change the shared secret regularly, and record who is authorized to use it.
MFA is especially valuable for remote access and cloud administration. If a legacy controller cannot perform MFA itself, enforce MFA at the jump host, VPN, identity provider, or other access layer in front of it.
3. Patch supported systems and replace unsupported ones
Apply security updates to operating systems, applications, firmware, gateways, remote-access software, and network devices when updates are available and compatible with the controlled process. CISA’s guidance pairs patching with replacement: an unsupported device or software package should not be treated as permanently secure simply because it still works.
Recommended Free Tools
Use an OT-safe change process
- Check the vendor’s release notes, supported versions, known limitations, and required prerequisites.
- Confirm which controller, HMI, driver, protocol, or safety function could be affected. Ask the vendor or an OT specialist to review the change when documentation is incomplete.
- Back up configurations, logic, recipes, certificates, and licensing information in a protected location. Verify that the backup can actually be restored.
- Test the update on a spare system, digital twin, or maintenance environment when one exists. Otherwise, schedule a controlled maintenance window with an agreed rollback plan.
- Verify alarms, interlocks, communications, set points, and manual fallback controls after the change. Record the version, date, tester, and result.
When patching is impossible
A vendor may no longer support an old operating system, or a patch may break a protocol required by a critical machine. Do not leave the system exposed while waiting for a perfect replacement. Remove unnecessary internet paths, restrict communication to the specific hosts and ports required for operation, place the asset in a separately controlled network zone, disable unused accounts and services when the vendor permits it, and increase monitoring. Treat these measures as temporary risk reduction, not as a substitute for a funded replacement plan.
Replacement planning should include procurement lead time, spare parts, configuration migration, operator training, and a tested return-to-service procedure. Record the target date and accountable owner so an unsupported device does not become an invisible permanent exception.
4. Put remote access behind a monitored jump host
Do not publish a PLC, HMI, SCADA server, or engineering workstation directly to the internet for convenience. When remote administration is necessary, route it through a hardened jump host (also called a bastion host) that is separated from the control network and monitored. CISA recommends secure, monitored jump-host access for exposed assets and enabling MFA where possible.
A practical remote-session sequence
- An authorized employee opens a request stating the asset, reason, vendor or technician, expected start and end time, and permitted actions.
- The access system verifies the user’s identity with MFA and checks that the request is approved.
- The user connects to the jump host, not to the controller’s public address. The jump host is allowed to reach only the required management interface.
- The session is logged; where legally and technically appropriate, record commands or screen activity. Monitor traffic for unexpected destinations, protocols, or data volume.
- At the end of the maintenance window, revoke the session and temporary account, review the log, and confirm that no permanent firewall or account change was left behind.
Vendor access should be time-limited and individually attributable. If a supplier insists on its own remote tool, place that tool behind the same controlled entry point and confirm what it installs, what outbound connections it makes, and how access is disabled.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Access design | Risk and availability profile | Appropriate use |
|---|---|---|
| Direct public access to a controller or HMI | Exposes a control interface continuously and makes misconfiguration easy to overlook. | Avoid. Remove the route even if it has never been abused. |
| Remote access through a jump host with MFA and logging | Adds an approval and monitoring layer while preserving necessary maintenance access. | Preferred pattern when remote administration is required. |
| Industrial firewall or OT segmentation appliance | Can enforce boundaries and log traffic, but compatibility, fail-safe behavior, updates, and configuration skill must be evaluated. | One possible implementation detail, selected through an OT design review. |
| Permanent vendor tunnel | May simplify support but leaves an ongoing path whose ownership and scope can be unclear. | Replace with controlled, time-bound access whenever the equipment and contract allow. |
CISA’s recommendations do not endorse a particular firewall, segmentation appliance, remote-access product, or vendor. Buying a device is not sufficient if rules are broad, credentials are shared, logs are ignored, or the device cannot safely handle the farm’s industrial protocols.
5. Segment control networks without endangering the process
Use network boundaries to keep office computers, guest Wi-Fi, cameras, cloud services, and internet-facing tools from having unrestricted access to controllers. The exact design depends on existing protocols and the consequences of interruption. A boundary device may be an industrial firewall, a router with carefully defined rules, or another segmentation mechanism; the technology is less important than a tested policy and competent maintenance.
Evaluate a boundary-control option
- Compatibility: Confirm support for the controller’s protocols, broadcast behavior, engineering software, time synchronization, and vendor diagnostics.
- Availability and safety: Determine what happens if the boundary device reboots, loses power, or blocks a required message. Define a safe operating state and a documented bypass procedure.
- Management and logging: Ensure administrators can review accepted and denied connections, export logs, and receive alerts when rules change.
- Support lifecycle: Check the supplier’s update process, end-of-support policy, spare hardware availability, and escalation path.
- Skills and ownership: Assign someone who understands both networking and the controlled process. An appliance that nobody can maintain becomes another unsupported asset.
Start with a documented list of required communications and deny everything else where the equipment allows it. Validate the rules during a maintenance window and keep a rollback copy of the configuration. Never assume that a segmentation change is harmless because it affects only network traffic; a blocked message can stop an interlock, alarm, or production sequence.
6. Monitor traffic and review exposure continuously
Monitoring should answer three questions: who connected, what they reached, and whether the activity matched an approved task. Collect authentication events from the jump host, firewall or boundary device, remote-access service, cloud portal, and critical servers. Alert on repeated failed logins, access outside approved windows, new public exposure, unexpected outbound destinations, and changes to control-system configurations.
Rank #4
- MOXA EDR-810-2GSFP Industrial Secure Router Switch with 8 10/100BaseT(X) ports, 2 1000BaseSFP slots, 1 WAN, Firewall/NAT, -10to60C -- NO VPN --
Keep clocks synchronized enough for logs from different devices to be correlated, protect logs from casual deletion, and decide how long they must be retained for troubleshooting and incident response. A small operation can begin with centralized alerts and a weekly human review rather than deploying an elaborate security platform it cannot operate.
Repeat the internet-exposure assessment after equipment purchases, network changes, vendor maintenance, and seasonal deployments. Include temporary cellular routers and laptops; temporary equipment often remains connected after the original job ends.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Prepare an incident-response plan for physical operations
Write the plan before an incident and test it. CISA’s ICS incident-response practice emphasizes having procedures in place and exercising them in a way that reflects the asset owner’s risk and operational needs. An office breach playbook is not enough if shutting down a controller could harm animals, spoil a crop, damage machinery, or create a safety hazard.
Define roles and decisions
- Name the incident lead, operations lead, IT or security contact, safety authority, communications contact, and vendor liaison.
- Specify who may isolate a network segment, disable a remote account, switch a process to manual control, or shut down equipment. Require an operations or safety review before taking an action that could create a physical hazard.
- Keep current contact details for equipment vendors, managed service providers, utilities, insurers, and law-enforcement or regulatory contacts that the farm may need.
Write response procedures around the process
- Detect and verify: Record the alert, affected asset, time, operator observations, and whether commands or set points changed.
- Protect people and animals: Follow established safe-operation and manual-control procedures before disconnecting anything. Do not unplug or patch safety-relevant equipment on impulse.
- Contain: Use the least disruptive effective action, such as ending a remote session, disabling a compromised account, or isolating a network path while keeping required local control.
- Preserve evidence: Protect logs, configuration backups, screenshots, and relevant system images. Avoid wiping or rebooting a system unless safety or recovery requires it.
- Recover: Restore from known-good configurations, validate alarms and interlocks, change exposed credentials, and reconnect systems in a controlled order.
- Learn: Document the cause, decisions, downtime, vendor assistance, and changes needed to prevent recurrence.
Exercise the plan
Run a tabletop scenario such as a compromised vendor account, a locked HMI, or an unauthorized command to an irrigation or refrigeration controller. Then test the specific recovery steps that can be performed safely. An exercise should reveal missing contact numbers, unavailable backups, unclear authority, and unsafe assumptions without disrupting live production.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute8. Make security workable during farm operations
Controls fail when they conflict with planting, harvest, livestock care, or emergency maintenance. Publish maintenance windows that operators and vendors can use, provide a documented manual fallback for critical processes, and train staff to report unexpected login prompts, alarms, or remote sessions without fear of delaying production.
Best Value
- 8+2G all-in-one firewall/NAT --- NO VPN-------/router/switch
- Build up secure remote access tunnel / Protect critical assets by stateful firewall
- Inspect industrial protocol with PacketGuard technology / Easy network setup with network address translation (NAT)
- RSTP/Turbo Ring redundant protocol enhances network redundancy / -40 to 75°C operating temperature range
- Security features based on IEC 62443 / NERC CIP / Check firewall settings with intelligent SettingCheck feature
Separate convenience from necessity. If a technician only needs read-only temperature data, do not grant command privileges. If a device requires a legacy protocol, isolate that requirement rather than allowing the entire office network to reach the controller. Review exceptions with an expiration date and an owner.
Budget for security as part of equipment lifecycle management. A new machine should be evaluated for account controls, update support, remote-access design, logging, backup, and safe recovery before it is connected. Contracts should state how vendor access is approved, logged, disabled, and transferred when the service relationship ends.
9. A prioritized implementation sequence
Farms with limited staff can make meaningful progress without redesigning every system at once. Use this order, adjusting it when a safety assessment identifies a more urgent hazard.
- First, find exposure: inventory internet-facing equipment, remote-access services, vendor links, and unsupported systems. Remove any public route that has no documented operational need.
- Next, close account gaps: change defaults, remove stale users, create named accounts where supported, and place remote administration behind MFA.
- Then, establish controlled access: deploy or configure a monitored jump host and define approval, time limits, logging, and termination for vendor sessions.
- After that, reduce lateral movement: document required traffic and implement tested network boundaries between office, guest, cloud, and control environments.
- Finally, make recovery real: patch supported systems through a tested process, fund replacement of unsupported equipment, protect configuration backups, and exercise the incident plan.
Revisit the sequence whenever a new connection, contractor, machine, cloud service, or seasonal deployment changes the farm’s exposure. The goal is not to make a farm permanently offline; it is to ensure that every necessary connection is deliberate, authenticated, limited, observed, and recoverable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
