Secure an operational technology (OT) network by first mapping what is connected and how the process depends on it, then reducing unnecessary connections, controlling the access that must remain, and monitoring for changes. Test and approve each production change with operations and engineering staff, and schedule it according to operational risk. OT controls can affect physical processes and essential services, so a change that looks routine on an IT network can have safety or continuity consequences on a plant floor.
Why OT security changes need operational planning
Operational technology includes systems used for process automation, instrumentation, cyber-physical operations, and industrial control. An incident—or a poorly planned security change—can affect operations, finances, the environment, health, and human safety. The goal is therefore not simply to block traffic. It is to reduce exposure while preserving the connections and functions the process needs.
As an Amazon Associate I earn from qualifying purchases.
There is no universal segmentation pattern, safe scanning method, or patch schedule for every facility. Equipment, process dependencies, vendor support, and safety behavior differ by site. Treat the guidance below as a method for making informed changes, not as a substitute for plant engineering, a safety case, or applicable sector and jurisdiction requirements.
Start with an inventory and dependency map
Before changing firewall rules, remote access, or device configurations, establish what is present and what depends on it. CISA describes asset inventory and monitoring as foundations for OT visibility. Its joint guidance also warns that insecure connections between OT and business applications can create paths for lateral movement.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Record the assets and their operational roles
For each known device or system, record its role, location, owner, criticality, supported version, and network connections. Include links to enterprise IT, vendors, cloud services, other control zones, and remote equipment. Capture enough process context to understand whether a device supports monitoring, control, safety, engineering, or another function.
Map flows and dependencies with site staff
Draw the current network paths and note which systems communicate, why they communicate, and what process or support activity depends on each connection. Confirm the map with operators and engineering staff; a connection that appears unused in a network diagram may support a maintenance or recovery function. Keep the inventory current as approved changes are made.
Do not indiscriminately run active scans or make discovery-related configuration changes on fragile control assets. The guidance cited here does not establish one universally safe scanning method. Plan discovery with asset owners and follow equipment-vendor guidance.
Recommended Free Tools
Rank #2
- INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 1 year of FortiCare Premium, and FortiGuard Unified Threat Protection.
- UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
- IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
- CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
- COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.
Reduce exposure while preserving required functions
Remove unnecessary connectivity and avoid direct public-internet exposure where feasible. A 2025 joint CISA, FBI, EPA, and DOE fact sheet states: “Remove OT connections to the public internet.” Apply that objective with a site-specific review of required data flows, safety functions, vendor support, and recovery access. CISA’s internet-exposure guidance says to “Review interdependencies to ensure that changes do not inadvertently disrupt essential services or operations.”
Separate OT from business networks
Use controlled network boundaries and permit only the flows needed for defined operational or support purposes. CISA’s Log4j advisory recommends placing control-system networks and remote devices behind firewalls and isolating them from the business network. A firewall or a new network zone is not automatically safe simply because it adds a boundary: engineers must determine what traffic is required and how the process behaves if a connection is blocked or lost.
Choose an approach based on the connection’s purpose
The options below are decision patterns, not competing designs that suit every site. The right choice depends on the required function and the consequences of changing it.
Rank #3
- 【NEWER MODEL AVAILABLE - Protectli Vault V1210】THE VAULT (FW2B): Secure your network with a compact, fanless & silent firewall. Comes with US-based Support & 30-day money back guarantee!
- CPU: Intel Celeron J3060 Dual Core at 1.6 GHz (Turbo 2.48 GHz), AES-NI hardware support
- PORTS: 2x Intel Gigabit Ethernet NIC ports, 4x USB 2.0, 2x USB 3.0, 1x RJ-45 COM, 2x HDMI
- COMPONENTS: Needs RAM & Storage to work! This is a Barebones unit for maximum customizability (no RAM or mSATA). Not all memory is compatible with the Vault! Please research "Vault Hardware Compatibility" before purchasing. coreboot BIOS optional, must be installed by user.
- COMPATIBILITY: No OS pre-installed. All hardware tested with pfSense, untangle, OPNsense and other popular open-source software solutions.
| Approach | When it may fit | What to verify before changing it |
|---|---|---|
| Remove public-internet connectivity | When an OT asset or network has a direct public-facing connection that is not required for safe, approved operations. | Required data flows, safety functions, vendor support, and recovery access; check interdependencies before disconnecting. |
| Use controlled conduits between OT and other networks | When necessary business, support, or data flows must cross a network boundary. | Which systems and flows are needed, how rules will be tested, and what happens if a flow is unavailable. |
| Retain a restricted, monitored access path | When remote or third-party access is required and cannot be removed. | Who is authorized, how access is authenticated and logged, and how it fits the approved plant architecture and recovery needs. |
Do not assume that one flat-to-segmented design fits every plant. The zones, conduits, permitted flows, and fail-safe behavior require site-specific engineering.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteControl remote and third-party access
Identify all remote access paths, including those used by employees, vendors, and support services. Remove connections that are unused or unmanaged. For access that must remain, CISA describes a jump host as a way to provide secure, monitored access and recommends multifactor authentication (MFA) where possible, including at the jump-host level.
Define who can authorize access, what systems a session can reach, how long access remains available, and where activity is logged. Coordinate access changes with operations so that they do not remove a needed maintenance or recovery path. These are implementation considerations; the cited guidance does not make a generic VPN sufficient by itself. Access controls need to match the connected devices and the plant’s approved architecture.
Rank #4
- 【◆Powerful Celeron N2840 Processor: N2840 Processor, 2 Cores 2 Threads, 1M Cache, Max Turbo Frequency 2.58 GHz, TDP 7.5 W. Compatible with OPNsense, Linux, Windows,ESXI, OpenWrt and other systems. Press "Delete" key to enter BIOS setup, supports Auto Power On, Wake On Lake, GPIO, PXE
- 【◆1GbE LAN: Mini Router PC with 2*Realtek RTL8111H network card chip full UDE 1000M with filter connector.Soft Router can monitor network data, improve network security, powerful and widely used.
- ◆DDR3L Memory & Large Storage Capacity: Firewall box computer with 1 x DDR3L SO-DIMM memory 1333/1600MHz, 1xMSATA3.0 SSD+1x2.5''SATA3.0 SSD/HDD.
- ◆UHD Graphics & Dual Display: N2840 processor integrated UHD Graphics, HD and VGA dual display interfaces support 4K@60Hz.
- ◆Rich interfaces: 2 x1000M Realtek RTL8111H-LAN,2 xUSB3.0, 4 xUSB2.0, HDMI,VGA,AUDIO supports data storage and system boot.
Monitor for activity that matters to the process
CISA’s ICS/OT monitoring considerations recommend evaluating OT-specific monitoring capabilities, maintaining asset discovery, and baselining expected network traffic. They identify useful detection areas such as suspicious communication across network boundaries, unexpected configuration changes, unauthorized applications, and unnecessary ports, protocols, or services.
Choose monitoring methods by checking whether they support the site’s equipment and protocols, where they provide visibility, what their deployment requires, and how alerts will be handled. Decide who investigates alerts and how findings enter incident response. The guidance identifies capabilities to evaluate; it does not establish the performance of any particular product or endorse a vendor.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Patch and change systems through a controlled process
Patch timing should account for both vulnerability exposure and the risk of affecting production. CISA’s Log4j advisory recommends using “a risk-informed decision-making process to apply the latest version of hotfixes or patches to affected devices as soon as is operationally feasible.” It also recommends testing updates in a development environment that reflects production and using vendor mitigations when patching cannot yet be done.
For each proposed network or software change, establish an impact assessment, operator and engineering coordination, representative testing, an approved implementation window, a rollback plan, and a way to verify the relevant safety functions. Backups and maintenance windows can support a controlled change, but neither makes an untested change safe on its own. If a patch must be deferred, document the exposure and apply applicable vendor mitigations while planning the next review.
Use decision gates before a production change
Apply these checks to a proposed disconnection, segmentation rule, access-control change, monitoring deployment, or patch. If a critical dependency or recovery path is unclear, resolve that uncertainty before changing production.
Quick Recap
- Purpose: Identify the risk the change is intended to reduce and the exact assets, connections, or services it affects.
- Dependencies: Confirm the affected flows and operational functions with asset owners, operators, engineering, and relevant vendors.
- Test: Use a representative environment where possible and verify both the intended security effect and the process behavior.
- Approval and timing: Coordinate with operations and schedule the change according to its assessed risk and operational feasibility.
- Recovery: Prepare a rollback or other recovery plan and verify required backups and access paths.
- Verification: After implementation, check that the intended controls work, required functions remain available, and monitoring can detect relevant changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →
