Not every vulnerable industrial computer can be updated on demand. A controller might depend on an operating system that is no longer supported. A production workstation may run a specialised application that has never been tested with modern endpoint protection. A plant may have one short maintenance window in which to make any change at all.
In these circumstances, ‘just install the latest patch’ is not a workable security strategy. The answer is to understand the exposure, reduce the ways a threat could reach the equipment and prepare to recover if something goes wrong. These measures are often called compensating controls: safeguards that reduce risk when a preferred control cannot yet be used.
Understand Why the Machine Cannot Be Patched
There is a difference between a temporary delay and a permanent constraint. Some systems can be patched after testing by the equipment manufacturer. Others rely on obsolete software, certification requirements or fragile integrations that make changes difficult. Recording the precise reason matters because it determines which alternatives are realistic.
Document the operating system, application versions, supported interfaces, system owner, service provider and maintenance arrangements. Identify which patches are unavailable, which await testing and which could affect safety or production. A statement such as ‘too old to patch’ offers little guidance; an evidence-based record gives engineering and security teams something they can act on.
Prioritise by Operational Consequence
Not every unsupported workstation presents the same risk. An isolated terminal used to view historical reports differs from a machine that can change the operation of pumps, valves or a production line. Assess the equipment’s function, the possible physical consequences of failure and the connections through which an attacker might reach it.
For industrial control systems security, this means considering safety, availability and process integrity alongside the confidentiality of information. Prioritise assets whose compromise could interrupt essential operations, impair protection mechanisms or make recovery difficult. The objective is a manageable list of decisions, not an inventory that labels every ageing device equally critical.
Build Protective Boundaries Around the Equipment
A vulnerable machine should communicate only with the systems it genuinely requires. Segment operational networks from routine office traffic, restrict connections between production areas and remove unused remote services. Where data must cross a boundary, use an explicitly designed transfer route rather than a general connection that allows unrestricted movement in both directions.
Consider what the machine can initiate as well as what can connect to it. Does it need access to the internet? Can it reach file shares outside its production zone? Does a maintenance laptop have more network privileges than the work requires? Restricting these paths can reduce the consequences of a successful compromise, even when the underlying software vulnerability remains.
Control Engineer and Supplier Access
Access to legacy equipment is often shared for practical reasons, but shared credentials can make changes difficult to attribute. Use individual accounts where the technology permits, protect privileged credentials and remove access when a contract or assignment ends. If a legacy system cannot support modern authentication, place controls on the approved access path rather than pretending the limitation does not exist.
Remote support should be time-limited, approved and monitored. Engineers should reach equipment through managed jump systems or equivalent controlled routes when practical. Record the purpose of each session and check that the provider cannot retain unnecessary access. Suppliers should understand that urgent maintenance does not automatically justify a permanent connection into operational networks.
Treat File Transfers as a Separate Risk
Network isolation does not eliminate the need for updates, configuration restores or production data exports. These tasks may depend on removable media, particularly when an engineering workstation cannot safely connect to ordinary business systems. The device and its content then become part of the security boundary.
Define which media are approved and how they are checked before use. A dedicated inspection point, including USB cyber security white stations where appropriate, can help examine files away from the equipment that must remain protected. Verify file origin and integrity where possible, retain transfer records and restrict what may be copied. Scanning reduces exposure to known threats but cannot guarantee protection against every malicious file or deceptive USB device.
Reduce What Can Run on Trusted Workstations
Where compatible with the operational application, allowlisting can limit execution to authorised software. Disabling unnecessary services, restricting administrative rights and preventing unapproved applications from running can narrow the opportunities for malware. Any change must first be assessed against the equipment’s actual operating requirements.
Test security changes on representative equipment or in an agreed maintenance window. A control that disrupts a controller connection or blocks essential diagnostics may create a greater operational problem than it solves. Keep a documented rollback route and involve operators in acceptance testing rather than treating the plant as an ordinary office network.
Prepare for Recovery Before a Failure
The most carefully isolated system can still fail through hardware faults, accidental changes or a cyber incident. Maintain recoverable copies of controller logic, configurations, licence information and relevant engineering software. Protect backups from routine modification and consider whether restoration requires obsolete hardware, proprietary tools or specialist knowledge.
A successful backup is not the same as a successful recovery. Test restoration in a suitable environment, verify that recovered settings match known-good values and record the time and people required. Keep procedures accessible during a network outage. For long-lived equipment, a tested replacement or migration plan may be the most valuable long-term security control.
Prove That Compensating Controls Work
An unsupported operating system should not disappear from risk reporting merely because a firewall has been installed. Assign an owner, document the remaining exposure and review the controls whenever the equipment, network or supplier relationship changes. Use monitoring that is safe for the environment, favouring passive methods where active scans could disrupt fragile devices.
Exercises should test realistic scenarios, such as an unexpected configuration change, a compromised maintenance account or a suspicious file arriving during an urgent repair. Confirm who can stop work, how equipment can be isolated and how the plant would resume safely. Findings should lead to specific actions with owners and dates.
Make Legacy Security a Managed Decision
Legacy industrial equipment is not automatically insecure, but its limitations need deliberate management. Map the system, restrict access, control incoming files, rehearse recovery and plan eventual replacement. When safety and availability shape every decision, organisations can reduce cyber risk without treating untested software changes as the only way forward.
