How to Secure Legacy Operational Technology Against Modern Cyber Threats

It's understood in organisations that operational technology (OT) is built around safety and reliability. For that reason, it's not unusual for manufacturing, transport and logistics OT to still be working hard 20 or 30 years after initial installation. On the one hand, that's incredible in a world where innovation drives change at an ever-increasing pace. On the other hand, it presents a whole new challenge: OT was designed at a time when cyberattacks were far less sophisticated; they were typically limited to opportunistic viruses, worms and basic malware rather than the highly coordinated attacks we see today.

OT may not have changed much since I entered the workplace, but the technology around it has. Fast forward to today, and I see nearly every operational system that was once isolated from the outside world is now connected to networks, cloud platforms and accessible through remote access. That connectivity creates obvious operational benefits, but it also creates new routes for cyber criminals to reach critical systems.

Unlike office technology, which can be swapped out with relative ease, replacing or updating OT isn't straightforward.

Many industrial control systems, Programmable Logic Controllers and Supervisory Control and Data Acquisition environments run on legacy hardware and software. Some cannot easily be patched, and others need to remain operational continuously. That means taking a system offline to deploy an update can have consequences far beyond somebody not being able to access their email for twenty minutes.

That's the challenge at the heart of OT cybersecurity.

A cyber-attack that reaches operational technology affects production, quality, safety, supply chains and compliance regulations. What begins as a cybersecurity problem quickly becomes a business continuity problem.

Three steps to securing operational technology

I believe the solution begins by focusing on three areas: visibility, protection and validation. Let me explain:

1. Visibility

You can't protect what you can't see. A good OT cybersecurity strategy starts by understanding what is connected to the outside world. Which systems are running? How do they communicate? Where do IT and OT networks meet? Which suppliers or engineers have remote access? And where could a breach potentially move laterally from one environment into another?

Every organisation will have a different answer. A manufacturing plant running continuously has different operational pressures from a distribution centre or transport network. That's why security begins with the reality of the operation rather than a standard list of controls.

Ricoh takes a discovery-led approach, building an understanding of an organisation's security posture, risk and operational goals before recommending the appropriate technologies and controls.

I see visibility becoming increasingly important as organisations connect operational systems to wider business technology.

2. Protection

Once you have visibility over your OT environment, the next challenge is protecting it without creating a new operational problem in the process.

This is where IT and OT security require very different thinking. The answer can't always be to patch, reboot, or replace a vulnerable system, as it may not be practical without disrupting production. Instead, protection must be designed around operational risk.

That could include controlling how third parties remotely access operational systems, limiting unnecessary connections between systems, and putting safeguards around how data moves between OT and the wider organisation. The principle is simple: security must work around the operation, not the other way around. Ricoh's OT approach embodies that reality. It includes establishing secure remote access for third parties and implementing controls to sanitise data, with the objective of ensuring operations stay safe, compliant and continuously available.

For organisations with legacy infrastructure, that really matters as you cannot redesign equipment that was installed decades ago, but you can control how it connects to the systems around it.

3. Validation

Finally, organisations need to know whether their defences work. Cyber-attacks evolve, networks change, and new technology is connected. What looked like a secure environment six months ago may now contain an attack surface that simply didn't exist before.

We use simulation to help validate OT defences without impacting production. Its wider security control validation approach couples human-led testing with automated validation and a continuous assurance model designed to find, fix and verify weaknesses as they arise.

Securing operational technology in practice

There is nothing inherently wrong with operational technology lasting 20 or 30 years. In many cases, its longevity is evidence of how well it was engineered. The security challenge comes when you try to protect it using security approaches designed for a much newer IT estate.

In my experience, most organisations understand that the risk exists. The bigger obstacle they face is the complexity of addressing it. When you are dealing with decades of infrastructure, specialist systems, third-party access and operations that need to remain continuously available, it can be tempting to defer the problem because implementing change is complex and difficult. That complexity is why OT security needs to be designed around the environment itself. That means understanding what is connected, where the risks sit and introducing controls that protect the operation without disrupting it.

No two OT estates are the same. That's why our cyber security team takes a discovery-led approach that prioritises your specific operational environment, helping protect critical systems while keeping them safe, compliant and continuously available.

• Learn more about our cyber security solutions by reading our eBook, Delivering digital continuity in an unpredictable world.
• Request a free cyber security discovery session and we’ll identify clear opportunities to strengthen your organisation's resilience.