Page 219 - Cyber Defense eMagazine RSAC Special Edition 2025

those connections is what truly mitigates risk. Without proper asset visibility and access segmentation, a
single compromised credential can provide an attacker with full access to the entire OT network.

Strengthening OT Security

So how can enterprises best mitigate growing risks without compromising on the benefits of digital
connectivity?

Start with a zero-trust approach to access management for all users: i.e., implementing identity-based
authentication and tightening access protocols so that they are at least as secure and restrictive for
contractors and third-party vendors as they are for internal employees. This requires replacing or
augmenting traditional VPNs with more advanced remote access solutions and enforcing multi-factor
authentication (MFA) across all access points, including legacy OT systems. Too many companies
concentrate on securing more modern applications but leave legacy infrastructure unprotected and thus
highly vulnerable.

To further strengthen third-party access security, enterprises should require their vendors and third-party
integration hosts to authenticate using identity-based access solutions rather than shared credentials or
perimeter-based models. Session-based access controls, for instance, can automatically revoke vendor
access once a task is completed, reducing the risk of lingering security gaps.

Another critical aspect of robust OT security is Remote Privileged Access Management (RPAM) – a
relatively new approach to securing and controlling privileged access to essential systems, data, and
resources. By enforcing the highest level of security for

privileged users, such as third-party vendors, remote workers, and anyone accessing mission-critical
assets, RPAM solutions punch far above their weight when it comes to mitigating risk. However, when it
comes to CPS environments, generic RPAM solutions are not enough. Secure remote privileged access
for CPS must be purpose-built to meet the unique needs of these environments, ensuring that real-time
industrial processes are protected without disrupting operational continuity.

Leveraging Regulation

Beyond the direct internal benefits of heightened OT security, implementing security best practices will
help organizations comply with a growing list of regulations and compliance mandates. Frameworks such
as ISA/IEC 62443, ISO 27001, and NIST CSF create a baseline for OT cybersecurity resilience, allowing
organizations to maintain compliance while reducing the potential operational downtime caused by cyber-
incidents. Many manufacturers still see compliance as a checkbox exercise but in reality, regulatory
alignment can make the difference between a minor security event and a full-scale operational crisis.

Finally, there is the Purdue Model: an approach to segmenting industrial control systems (ICS) into
hierarchical layers. This is done to limit access between IT and OT and, in turn, reduce cyber
vulnerabilities. Network segmentation enforces strict access controls, preventing threats from spreading
laterally between networks. Each zone of the Purdue Model has its own security considerations, with

219