# Industrial Cyber Security Best Practices

- Link: https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/
- Published: 2026-04-19T16:47:10+00:00
- Author: Don Bowman

1. [Home](https://www.agilicus.com/)
 2. Industrial Cyber Security Best Practices

# Industrial Cyber Security Best Practices

![security-best-practices-guide](https://www.agilicus.com/www/1641c6ff-security-
best-practices-guide.webp)

At Agilicus, we recognise that the convergence of business networks and industrial
control systems creates unprecedented hybrid environments. This document is a blueprint
for anyone who operates both Information Technology and Operational Technology in
a hybrid capacity. It is designed not as a static checklist, but as a strategic 
guide to govern your ongoing security investments.

This best practices guide is meant to be paired directly with our [Cyber Security Assessment Scorecard](https://www.agilicus.com/l/industrial-cyber-security-best-practices-scorecard/)
as well as industry standards such as NIST SP 800-82r3. While the scorecard measures
your current posture and highlights the gaps, this blueprint provides the architectural
roadmap to address them. These are not binary tasks to complete once and forget;
they are a set of foundational practices that must be continuously improved across
the board.

Below we present 5 separate, orthogonal dimensions. Each is a unique vector to invest
in reducing your cyber risk and increasing your controls. For each we present some
best practice concepts that relate.

# Industrial Cyber Security Best Practices

## Executive Summary

On this page

 * [Executive Summary](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#executive-summary)
 * [Boundary Defence](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#boundary-defence)
 * [Identity & Credentials](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#identity-credentials)
 * [Lateral Movement](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#lateral-movement)
 * [System Hardening](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#system-hardening)
 * [Visibility & Detection](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#visibility-detection)
 * [Appendix: Understanding the Purdue Model](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#appendix-understanding-the-purdue-model)
 * [Appendix: Defence in Depth and the Swiss Cheese Model](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#appendix-defence-in-depth-and-the-swiss-cheese-model)
 * [Appendix: Frequently Asked Questions](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#appendix-frequently-asked-questions)

At Agilicus, we recognise that the convergence of business networks and industrial
control systems creates unprecedented hybrid environments. This document is a blueprint
for anyone who operates both Information Technology and Operational Technology in
a hybrid capacity. It is designed not as a static checklist, but as a strategic 
guide to govern your ongoing security investments.
The core philosophy underpinning
this guide is [Defence in Depth](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#defence-in-depth-appendix).
We do not believe any single control point is absolute; every perimeter will eventually
face a threat it was not designed to handle. Instead, we architect fallback defences
based on the Swiss cheese model. Every defensive layer has inherent flaws: the holes
in the [cheese](https://en.wikipedia.org/wiki/Swiss_cheese_model), but by stacking
multiple, distinct layers, you ensure that a single point of failure does not cascade
into a total systemic breach.

![Generated Image April 14, 2026 – 9_41PM](https://www.agilicus.com/www/5092f6cc-
generated-image-april-14-2026-9_41pm-scaled.jpg)

Crucially, the practices outlined here are completely orthogonal. They control different
risks using entirely different mechanisms. An adversary bypassing a network boundary
does not automatically bypass an identity control, meaning an escape of one layer
is not an escape of another.
This best practices guide is meant to be paired directly
with our Cyber Security Assessment Scorecard as well as industry standards such 
as [NIST SP 800-82r3](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf).
While the scorecard measures your current posture and highlights the gaps, this 
blueprint provides the architectural roadmap to address them. These are not binary
tasks to complete once and forget; they are a set of foundational practices that
must be continuously improved across the board.Below we present 5 separate, orthogonal
dimensions. Each is a unique vector to invest in reducing your cyber risk and increasing
your controls. For each we present some best practice concepts that relate.

## **_Boundary Defence_**

Traditional perimeter security relied on the illusion of an air gap, but in modern
operational technology environments, the air gap is no longer feasible. This dimension
focuses on securing the multiple boundaries defined by the Purdue model (see [ISA99](https://www.isa.org/standards-and-publications/isa-standards/isa-standards-committees/isa99))(
e.g., from the outside world to the corporate information technology firewall, and
from the information technology network into the operational technology network).
It enforces the principle that external remote services and cloud connections must
be fundamentally re-architected. Legacy virtual private networks and open inbound
ports are obsolete; they must be replaced with outbound-only reverse tunnels and
modern secure remote access.

![image-1—2d99e6a4-c36d-411c-9100-a6e818d62fba](https://www.agilicus.com/www/237ee549-
image-1-2d99e6a4-c36d-411c-9100-a6e818d62fba-scaled.jpg)

### _Multi-Layer Boundary Enforcement_

The proliferation of interconnected devices means that a flat network is an open
invitation for total compromise. When corporate systems bleed into industrial control
environments, a single compromised workstation on the business side easily cascades
into a physical disruption on the plant floor. We must construct hard boundaries
between Information Technology, Operational Technology, and external vendors. This
structural separation forms the bedrock of defence in depth; an attacker who breaches
the corporate perimeter still faces an entirely isolated, heavily inspected environment
before they can touch a safety instrumented system.

A common model describing internal security boundaries is the Purdue model [(see Appendix: Understanding the Purdue Model)](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/#purdue-appendix).

 * Define strict physical and logical separation between the corporate network and
   operational technology network.
 * Mandate firewall inspection at every boundary crossing.
 * Isolate safety instrumented systems from all other networks.
 * Implement a demilitarised zone for shared services.
 * Deny all direct routing between the internet and operational technology assets
   in both inbound and outbound direction.

### _Elimination of Inbound Ports_

Publicly exposed inbound ports are a liability that search engines and automated
scanners actively exploit. Relying on an open listener on your perimeter firewall
guarantees that adversaries will repeatedly test your defences until they find a
weakness. The architectural shift requires eliminating inbound ports completely.
By forcing all external integrations to rely on polled, outbound-only connections,
you render the operational technology environment invisible from the public internet.
This removes the attack surface at the edge, drastically reducing the friction of
constant patching and external monitoring.

 * Audit all perimeter firewalls for open inbound ports.
 * Close direct inbound access for legacy remote desktop and virtual private networks.
 * Replace inbound listeners with outbound-only reverse tunnels.
 * Ensure external integrations rely on polled, outbound connections.
 * Block search engines from mapping perimeter edge devices.

### _Modern Remote Access Architecture_

Granting full network routing via legacy virtual private networks is equivalent 
to handing a contractor the master keys to the building just so they can fix a single
sink. Traditional jump boxes and shared remote access tools fail to provide the 
granular control required in modern industrial environments. Instead, access must
be brokered through an identity-aware proxy that limits the user strictly to the
application they need. Terminating the session at the application layer breaks the
direct routing path, meaning an infected remote machine cannot spread malware laterally
into the operational technology network.

 * Deprecate legacy VPN appliances.
 * Remove shared remote access software (such as TeamViewer or AnyDesk).
 * Implement an identity-aware proxy for all external access.
 * Require continuous authorisation for every remote session.
 * Terminate remote sessions at the application layer rather than granting network
   routing.

### _Alternate Perimeter Control_

Vendors frequently install rogue cellular modems or undocumented wireless access
points to bypass strict corporate firewalls, prioritising maintenance convenience
over security. These alternate perimeters act as hidden backdoors, entirely subverting
the primary boundary defences you have meticulously designed. Identifying and eliminating
these undocumented connections is critical. By enforcing strict network access control
and physically auditing the environment, you ensure that all traffic is forced through
the designated, heavily inspected chokepoints.

 * Conduct physical audits for unauthorised cellular modems.
 * Disable or strictly isolate guest wireless networks near operational technology
   environments.
 * Block unauthorised vendor backdoors installed during commissioning.
 * Implement network access control for physical switch ports.
 * Monitor for dual-homed devices bridging corporate and operational technology 
   networks.

### _Outbound Traffic Restriction_

A compromised internal device must communicate with an external command and control
server to receive instructions or exfiltrate data. If outbound traffic from the 
operational technology network is permitted by default, attackers face zero resistance
once inside. Implementing a strict default-deny posture for outbound traffic turns
this vulnerability into a containment trap. By explicitly defining which internal
devices are allowed to communicate externally and filtering that traffic through
deep inspection, you ensure that malicious beacons fail to connect, buying time 
for the security team to respond.

 * Implement a default-deny posture for all outbound operational technology traffic.
 * Restrict necessary outbound connections to explicit Internet Protocol addresses
   and specific domain names.
 * Inspect outbound traffic using next-generation firewall application filters.
 * Block outbound access to known malicious infrastructure and generic cloud storage.
 * Alert on newly established outbound connection patterns.

## **_Identity & Credentials_**

Identity is the new air gap. In an environment where network boundaries are increasingly
porous, robust authentication is the primary line of defence. This dimension mandates
the shift to a zero-trust architecture where identity is unified and heavily verified.
It covers the eradication of shared accounts, default vendor passwords, and static
credentials. A modern approach dictates that third-party vendors bring their own
identity provider, allowing operators to enforce granular, resource-specific authorisation(
e.g., read-only access to a specific human-machine interface) without creating new
local accounts.

![image-1—3efc907c-0580-4c9d-9298-7f569ec4b2d3](https://www.agilicus.com/www/5cb82e67-
image-1-3efc907c-0580-4c9d-9298-7f569ec4b2d3-scaled.jpg)

### _Phishing-Resistant Multi-Factor Authentication_

Relying on passwords alone is a proven failure, and legacy authentication methods
like short message service codes are easily intercepted by modern threat actors.
When administrative access to an infinitely important role relies on weak authentication,
the entire perimeter is compromised the moment a credential is stolen. We believe
phishing-resistant multi-factor authentication, such as hardware security keys, 
is an absolute necessity. This ties the digital identity to a physical token, ensuring
that stolen passwords cannot be leveraged by a remote attacker, adding a crucial
layer of defence in depth.

 * Mandate hardware security keys for highly privileged administrative access.
 * Disable short message service and email-based authentication methods.
 * Require multi-factor authentication for both local and remote access attempts.
 * Protect authentication portals from brute-force and credential stuffing attacks.
 * Implement session timeouts that require re-authentication for idle sessions.

### _Unified Identity and Single Sign-On_

When operators manage hundreds of separate local accounts across disparate human-
machine interfaces, password reuse and credential sprawl become inevitable. This
operational friction results in dormant accounts remaining active long after an 
employee departs, providing a silent vector for exploitation. Unifying identity 
through a single corporate directory eliminates this risk. Centralised authentication
allows for immediate, global revocation of access when personnel change, ensuring
that the operational technology environment remains strictly governed by a single
source of truth.

 * Centralise all human identities within a single corporate directory.
 * Disable local accounts on individual programmable logic controllers and human-
   machine interfaces.
 * Federate authentication using modern secure protocols.
 * Ensure immediate session revocation when an identity is disabled centrally.
 * Enforce unique, centrally managed passwords where single sign-on is technically
   impossible.

### _Third-Party and Vendor Access_

Creating static, local accounts for third-party vendors typically results in shared
passwords and non-expiring access, making it impossible to confidently verify who
is actually connecting to your systems. As supply chains become more integrated,
managing the lifecycle of these external identities creates immense administrative
overhead. Permitting vendors to authenticate using their own native corporate identity
provider shifts the burden of credential management back to them. You no longer 
store their passwords; you simply authorise their verified identity to access specific
resources for a limited time.

 * Eliminate shared generic accounts.
 * Allow contractors to use their own corporate identity provider.
 * Implement time-bound access that automatically expires.
 * Require vendors to meet device posture checks before authentication.
 * Audit vendor access logs against active support tickets or maintenance windows.

### _Granular Role and Resource Authorisation_

Granting broad administrative access simply because an engineer needs to monitor
a single process violates the core tenet of least privilege. When users possess 
more access than required, any compromised account becomes a highly destructive 
tool in the hands of an attacker. Granular authorisation ensures that roles are 
mapped tightly to specific tasks and individual devices. By decoupling network access
from application access, you ensure that a contractor viewing read-only telemetry
cannot inadvertently or maliciously issue a stop command to a programmable logic
controller.

 * Restrict access on a strict least-privilege basis.
 * Map user roles directly to specific applications or individual assets.
 * Separate read-only monitoring access from read-write engineering access.
 * Prevent users from accessing unrelated resources within the same physical site.
 * Require secondary approval for high-risk configuration changes.

### _Machine-to-Machine Authentication_

Static application programming interface keys are often embedded directly into scripts
and rarely rotated, acting as immortal passwords for automated systems. If an attacker
extracts one of these keys from a compromised server, they gain unfettered, persistent
access to internal interfaces. The modern approach requires abandoning static secrets
in favour of short-lived tokens and continuous authorisation. By cryptographically
binding machine identities to specific hardware and requiring frequent token renewals,
the window of opportunity for an attacker to misuse a stolen credential is fundamentally
eliminated.

 * Rotate service account passwords automatically.
 * Replace static application programming interface keys with short-lived tokens.
 * Bind machine identities to specific hardware using certificates.
 * Enforce mutual transport layer security for system-to-system communication.
 * Alert on anomalous service account usage outside of scheduled automation.

## **_Lateral Movement_**

If an attacker breaches the perimeter, their next step is to navigate the internal
network. This dimension addresses how easily a threat actor can move once inside.
It requires moving away from flat networks and permissive routing. By applying micro-
segmentation and eliminating the use of inherently vulnerable protocols like remote
desktop or legacy Microsoft authentication, organisations can contain breaches. 
Defence in depth here means ensuring that even authenticated sessions are brokered
at the application layer, preventing broad network discovery.

![image-1—af105fe4-8116-4e96-8bed-4ab5164771c9](https://www.agilicus.com/www/cdbb83f7-
image-1-af105fe4-8116-4e96-8bed-4ab5164771c9-scaled.jpg)

### _Network Micro-Segmentation_

A flat internal network operates under the flawed assumption that everything inside
the perimeter is trusted. Once an adversary bypasses the external firewall, this
lack of internal friction allows them to move laterally with absolute impunity, 
discovering and compromising critical assets. Micro-segmentation divides the operational
technology environment into tightly controlled functional zones. By enforcing strict
rules that govern which devices can communicate with one another, you ensure that
a compromised engineering workstation cannot freely connect to unrelated process
controllers, containing the blast radius of a breach.

 * Divide the operational technology network by functional process areas.
 * Restrict communication between devices in different process zones.
 * Implement host-based firewalls on all engineering workstations.
 * Prevent programmable logic controllers from initiating connections to engineering
   workstations.
 * Use software-defined perimeters to enforce access policies.

### _Legacy Protocol Eradication_

Legacy administrative protocols like Remote Desktop Protocol and Windows Admin Shares
were designed for convenience, not security, and they are the primary mechanisms
attackers use to navigate internal networks. Leaving these protocols enabled by 
default provides built-in highways for adversaries to deploy ransomware across the
entire industrial control system. Eradicating or heavily brokering these protocols
removes the native tools attackers rely on to live off the land. This significantly
elevates the difficulty of lateral movement, forcing the attacker to generate noisy,
detectable traffic.

 * Disable Remote Desktop Protocol internally unless explicitly required and brokered.
 * Block Windows Admin Shares and Server Message Block traffic between workstations.
 * Prevent the use of cleartext protocols like Telnet and File Transfer Protocol.
 * Restrict the execution of remote procedure calls.
 * Monitor for the use of legacy industrial protocols lacking native authentication.

### _Application-Layer Brokering_

When users authenticate to a traditional gateway, they are typically granted access
to a full subnet, allowing their machine to ping and map the surrounding network
architecture. This broad visibility is an intelligence goldmine for threat actors
conducting reconnaissance. Application-layer brokering fundamentally alters this
dynamic by establishing connections only to the specific service requested, never
dropping the user directly onto the network itself. Because the network topology
remains hidden from the endpoint, lateral discovery becomes impossible, deeply reinforcing
the overall defence in depth strategy.

 * Prevent remote users from pinging or discovering unrelated network assets.
 * Broker all administrative connections through a secure bastion or proxy.
 * Inspect session traffic for malicious payloads before it reaches the asset.
 * Enforce clipboard and file transfer restrictions on brokered sessions.
 * Terminate and re-establish sessions at the gateway to break direct routing.

### _Credential Protection_

Microsoft Windows environments often retain legacy authentication protocols in memory,
allowing attackers who compromise a single machine to extract hashed passwords and
impersonate administrators without ever cracking the plaintext password. This pass-
the-hash technique turns a minor endpoint compromise into a full domain takeover.
Restricting legacy protocols and enforcing modern memory protections, such as Windows
Defender Credential Guard, isolates these secrets from malicious processes. By defending
the credentials themselves, you break the attacker’s ability to escalate privileges
as they move laterally.

• Disable NT LAN Manager authentication globally.

 * Enforce Windows Defender Credential Guard to protect secrets in memory.
 * Restrict administrative accounts from logging into lower-tier workstations.
 * Monitor for credential dumping tools and suspicious memory access.
 * Implement restricted admin mode for necessary remote desktop connections.

### _Internal Traffic Encryption_

Unencrypted internal traffic permits an adversary who has gained a foothold to silently
observe administrative sessions and capture sensitive commands or credentials in
plaintext. While encryption at the boundary is common, failing to encrypt east-west
traffic leaves the interior of the network completely exposed to eavesdropping. 
Enforcing end-to-end encryption using a managed internal certificate authority ensures
that all system-to-system communication is secure. Combined with active certificate
revocation checking, this prevents attackers from using stolen or expired certificates
to forge trusted internal connections.

 * Encrypt all administrative sessions (like secure shell and hyper-text transfer
   protocol secure).
 * Deploy certificates from a managed internal certificate authority.
 * Enforce active certificate revocation checking within the environment.
 * Replace self-signed certificates on critical operational technology infrastructure.
 * Isolate unencrypted legacy traffic on dedicated, heavily monitored network segments.

## **_System Hardening_**

Threat actors often “live off the land” by exploiting native administrative utilities
to avoid detection. This dimension focuses on the restriction of tools and the rigorous
enforcement of configuration baselines on all equipment, from standard servers to
programmable logic controllers. It encompasses the application of standardised security
frameworks (like National Institute of Standards and Technology guidelines or Centre
for Internet Security Benchmarks), the lockdown of scripting environments, and the
strict management of firmware updates to ensure unauthorised changes cannot persist.

![image-1—9d9e071e-c2df-4667-9ca6-dedca0a8628c](https://www.agilicus.com/www/eeafec07-
image-1-9d9e071e-c2df-4667-9ca6-dedca0a8628c-scaled.jpg)

### _Administrative Tool Restriction_

Modern threat actors prefer to ‘live off the land,’ leveraging native administrative
utilities like PowerShell and the command-line interface to execute malicious payloads
without triggering traditional antivirus alarms. If standard operators have unfettered
access to these powerful tools, the system is primed for exploitation. Locking down
scripting environments and enforcing application whitelisting ensures that only 
explicitly approved executables can run. This defensive layer strips the adversary
of the built-in weapons they rely on, forcing them to import external tools that
are much easier for security teams to detect.

 * Restrict the use of PowerShell to designated administrative service accounts.
 * Disable the command-line interface for standard operators.
 * Implement application whitelisting to block unauthorised executables.
 * Monitor the execution of native Windows Management Instrumentation tools.
 * Remove unnecessary software and utilities from industrial control devices.

### _Configuration Management_

Operational technology environments are often manually configured, leading to a 
slow degradation of security posture known as configuration drift. When systems 
deviate from their secure baselines, it creates silent vulnerabilities and allows
attackers to establish persistence through hidden scheduled tasks or altered startup
services. Robust configuration management automates the enforcement of secure settings
across all endpoints. By continuously monitoring for drift and immediately alerting
on unauthorised changes, you guarantee that the intended defence in depth architecture
remains actively enforced over the lifecycle of the equipment.

 * Establish secure baselines for all operational technology endpoints.
 * Monitor critical assets continuously for configuration drift.
 * Track all configuration changes in a centralised change management system.
 * Automate the deployment of secure configurations where possible.
 * Alert on unauthorised creation of scheduled tasks or background services.

### _Standardised Security Baselines_

Deploying industrial equipment with factory-default configurations is equivalent
to installing a high-security door and leaving the factory default combination on
the lock. These unhardened systems contain unnecessary services, open ports, and
default passwords that are universally known to attackers. Applying rigorous, industry-
standard baselines, such as Centre for Internet Security benchmarks, systematically
eliminates these vulnerabilities before the equipment enters production. This hardening
process establishes a consistent, defensible foundation that significantly narrows
the available attack surface for any adversary.

 * Apply [Centre for Internet Security benchmarks](https://www.cisecurity.org/cis-benchmarks)
   or equivalent to all standard operating systems.
 * Implement vendor-provided hardening guidelines for specific industrial control
   systems.
 * Remove default factory configurations and default passwords before deployment.
 * Disable unnecessary network services and daemons.
 * Conduct periodic reviews of applied baselines against current threat intelligence.

### _Firmware and Software Integrity_

Supply chain attacks have demonstrated that even legitimate software updates can
be weaponised if their integrity is not rigorously verified. Installing unverified
firmware on a programmable logic controller can introduce deep, persistent backdoors
that bypass all external network defences. A rigorous integrity management process
ensures that every piece of software is cryptographically signed by a trusted authority
before execution. By centrally managing and verifying these updates, organisations
ensure that only authentic, unmodified code runs on their critical infrastructure.

 * Centralise the management of firmware updates for all network devices.
 * Verify cryptographic signatures of all software updates before installation.
 * Maintain offline backups of known-good firmware versions.
 * Test updates in a staging environment prior to production deployment.
 * Enforce a strict change control process for all software modifications.

### _Immutable Infrastructure Principles_

Traditional systems treat data and operating environments as a single, changeable
entity, meaning a successful compromise permanently alters the state of the machine.
This allows rootkits and malware to embed themselves deeply within the system files.
Immutable infrastructure principles decouple the operating system from persistent
data, utilising read-only file systems wherever possible. If an unauthorised modification
is detected, the system can be instantly reverted or rebuilt from a known-good image,
effectively erasing the attacker’s foothold and guaranteeing the absolute integrity
of the endpoint.

 * Utilise read-only file systems for critical operational technology devices where
   supported.
 * Implement automated mechanisms to revert unauthorised changes instantly.
 * Rebuild compromised systems from trusted images rather than attempting manual
   repair.
 * Separate persistent data storage from the underlying operating system.
 * Treat configuration as code to ensure consistent, reproducible deployments.

## **_Visibility & Detection_**

You cannot defend what you cannot see. As autonomous agents and sophisticated threats
evolve, deep network visibility is mandatory. This dimension scores the ability 
to detect anomalous behaviour and respond swiftly. It shifts the focus from basic
boundary logging to comprehensive, identity-aware audit trails that capture granular,
layer-7 requests. It also mandates full traffic capture across all levels of the
Purdue model and real-time, automated inventory management.

![image-1—cb8f9785-5361-46d1-bf5a-97e2c96b2513](https://www.agilicus.com/www/551a1b4f-
image-1-cb8f9785-5361-46d1-bf5a-97e2c96b2513-scaled.jpg)

### _Centralised and Identity-Aware Logging_

Network-level logging that only records Internet Protocol addresses provides a fragmented,
often useless picture during a forensic investigation. When multiple contractors
share the same jump box, determining who actually initiated a malicious command 
becomes impossible. Centralised, identity-aware logging solves this by capturing
highly granular, application-layer requests and tying every single action back to
a specific, verified human identity. These cryptographically verifiable audit trails
ensure non-repudiation, giving security teams the precise visibility required to
understand exactly who did what, and when.

 * Forward all security logs to a central security information and event management
   system.
 * Ensure logs capture layer-7 details, including the exact file or uniform resource
   locator accessed.
 * Tie every administrative action back to a specific, verified human identity.
 * Protect log archives from tampering or unauthorised deletion.
 * Retain audit logs in accordance with regulatory and incident response requirements.

### _Automated Anomaly Detection_

Static, signature-based antivirus software is routinely bypassed by novel malware
and sophisticated attackers who operate entirely within the bounds of legitimate
system tools. To detect these modern threats, defence mechanisms must understand
what normal operation looks like in a highly deterministic industrial environment.
Automated anomaly detection leverages behavioural analytics to continuously monitor
protocol usage and data flows. When a programmable logic controller suddenly attempts
to initiate an outbound connection to the internet: a stark deviation from its baseline,
the system flags the anomaly immediately, catching the adversary before the attack
escalates.

 * Establish a baseline of normal network behaviour and protocol usage.
 * Deploy behavioural analytics to detect deviations, such as unexpected outbound
   connections.
 * Alert on abnormal login times or physical locations for operational technology
   personnel.
 * Detect unusual data transfer volumes indicating potential exfiltration.
 * Monitor for the introduction of new, unrecognised devices on the network.

### _Deep Packet Inspection and Traffic Capture_

Attackers who successfully breach the perimeter will attempt to blend their malicious
commands into the ambient noise of standard industrial protocols. Basic firewall
rules simply verify the port and Internet Protocol address, completely ignoring 
the payload inside the packet. Deep packet inspection examines the actual content
of the network traffic, identifying malformed packets or unauthorised read-write
commands hidden within legitimate protocols. Combined with continuous traffic capture
across all layers of the Purdue model, this provides defenders with the ultimate
truth of what is occurring on the wire, ensuring no malicious activity goes unnoticed.

 * Deploy network intrusion detection systems at all critical Purdue model boundaries.
 * Utilise deep packet inspection to identify malicious payloads within industrial
   protocols.
 * Maintain rolling packet captures to support post-incident forensics.
 * Monitor internal east-west traffic, not just perimeter north-south traffic.
 * Correlate network traffic alerts with host-based security events.

### _Real-Time Asset Inventory_

You cannot defend what you do not know exists. Relying on static, manually updated
spreadsheets to track operational technology assets guarantees that security teams
are operating with an outdated and inaccurate map of the environment. A real-time
asset inventory uses automated discovery to continuously track hardware models, 
operating systems, and specific software libraries. This dynamic visibility ensures
that when a new critical vulnerability is announced, the organisation can immediately
identify exactly which devices are affected, eliminating blind spots in the defence
strategy.

 * Implement automated tools to continuously discover and classify network assets.
 * Track hardware models, operating system versions, and installed software packages.
 * Identify and flag devices running unsupported or end-of-life software.
 * Map dependencies between operational technology assets and required corporate
   services.
 * Reconcile automated discovery data against physical inventory records periodically.

### _Automated Incident Response_

Human reaction time is insufficient when facing automated ransomware that can encrypt
an entire facility in minutes. If the security operations centre must manually review
logs, convene a meeting, and then issue firewall commands to stop an attack, the
battle is already lost. Automated incident response translates visibility into immediate
action. By programmatically isolating compromised assets or terminating suspicious
user sessions the moment a critical anomaly is detected, the system contains the
threat at machine speed, preserving the operational integrity of the larger environment.

 * Develop automated playbooks for common threat scenarios.
 * Isolate compromised assets dynamically using network access control or software-
   defined perimeters.
 * Terminate active user sessions upon detecting suspicious behaviour.
 * Block known malicious Internet Protocol addresses and domains automatically.
 * Trigger immediate alerts to the security operations centre for critical operational
   technology events.

Incident response and reporting may be mandated for your jurisdiction and industry.
Common such standards include:

 * [Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)](https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia)
 * [SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure](https://www.sec.gov/rules-regulations/2023/07/s7-09-22)

## Appendix: Understanding the Purdue Model

If you are tasked with securing an industrial environment, the Purdue Model is the
architectural blueprint you must understand before placing a single firewall. You
cannot defend what you do not understand structurally.

![Purdue With Agilicus Connector Overlay-Purdue Only](https://www.agilicus.com/www/
bc7dd644-purdue-with-agilicus-connector-overlay-purdue-only.png)

### **_Origins and Purpose_**

Developed in the 1990s by Theodore Williams at Purdue University, the framework 
was originally known as the Purdue Enterprise Reference Architecture. At its inception,
it was not a cyber-security framework; it was an organisational model designed to
map the flow of data and control in manufacturing. It defined how physical processes,
basic control devices, and corporate business systems should logically interact 
to improve efficiency.

Over time, as Information Technology and Operational Technology began to converge,
security practitioners adopted the Purdue Model. It provided the perfect structural
map to define where network boundaries should exist. By segmenting the environment
into distinct hierarchical levels, engineers could enforce strict access controls,
ensuring that a compromised corporate email account could not directly issue commands
to a physical pump or valve.

### **_The Hierarchical Levels_**

The model divides industrial operations into separate zones, typically ranging from
the physical process up to the corporate enterprise:

 * **Level 0 (The Physical Process):** The actual physical equipment doing the work,
   such as motors, pumps, valves, and sensors.
 * **Level 1 (Basic Control):** The devices that sense and manipulate the physical
   process, such as programmable logic controllers and remote terminal units.
 * **Level 2 (Supervisory Control):** The systems used by operators to monitor the
   plant floor, including human-machine interfaces and Supervisory Control and Data
   Acquisition software.
 * **Level 3 (Site Operations):** Systems that manage production across the facility,
   such as manufacturing execution systems or historian databases.
 * **Demilitarised Zone:** The critical buffer zone inserted between the industrial
   network and the corporate network to broker shared services and prevent direct
   network routing.
 * **Levels 4 and 5 (Corporate Information Technology):** The enterprise network
   where business functions, email, and corporate servers reside, eventually connecting
   to the external internet.

### **_Foundation for Industry Standards_**

Because it elegantly defines the boundaries between different types of systems, 
the Purdue Model serves as the structural baseline for the world’s most critical
industrial cyber-security standards. 

The International Society of Automation (ISA-99) and the International Electrotechnical
Commission 62443 standards use the Purdue Model concepts to define “zones” and “
conduits.” These standards mandate that systems with similar security requirements
be grouped into a secure zone, and that communication between zones only occurs 
through tightly controlled, heavily inspected conduits.

Similarly, the National Institute of Standards and Technology relies heavily on 
the Purdue Model. In their guidelines for securing industrial control systems, they
use the framework to illustrate how defence in depth should be practically applied.
When auditors or regulators assess an industrial facility, they invariably look 
for adherence to this layered, segmented architecture.

### **_Authoritative References_**

For a deeper understanding of how the Purdue Model is applied to secure critical
infrastructure, consult the following authoritative sources:

 * [**United States Department of Energy**: Infrastructure Topic Paper on Industrial Control Systems Security. Provides a strategic overview of securing energy infrastructure based on segmented architectures.](https://www.energy.gov/sites/default/files/2022-10/Infra_Topic_Paper_4-14_FINAL.pdf)
 * [**National Institute of Standards and Technology**: Special Publication 800-82, Revision 3. The definitive guide to securing industrial control systems, which relies heavily on the zone and conduit models to restrict lateral movement.](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf)
 * [**SANS Institute**: Introduction to Industrial Control Systems Security. A practical breakdown of how security professionals map defensive strategies to the hierarchical Purdue levels.](https://www.sans.org/blog/introduction-to-ics-security-part-2)
 * [NERC CIP (Critical Infrastructure Protection)](https://www.nerc.com/standards/reliability-standards/cip)

## Appendix: Defence in Depth and the Swiss Cheese Model

### **_The Philosophy of Inevitable Failure_**

Defence in depth is not merely a technical architecture; it is a philosophy built
on the acknowledgement of inevitable failure. Historically, organisations relied
on a single, hardened perimeter: a supposedly impenetrable air gap or a massive 
perimeter firewall. This approach is fundamentally brittle. A single layer of defence
with a single strategy means that once a threat actor finds a vulnerability, they
achieve total compromise. True defence in depth requires deploying multiple, overlapping
defensive measures so that if one mechanism fails, another stands in its way.

![image-1—2b1ca48c-c6a2-4214-aaf9-3d125317cf89](https://www.agilicus.com/www/4d823d83-
image-1-2b1ca48c-c6a2-4214-aaf9-3d125317cf89-scaled.jpg)

### **_Uncorrelated Tactics and the Swiss Cheese Model_**

The core mechanism of effective defence in depth is best illustrated by the [Swiss Cheese model of risk and security](https://en.wikipedia.org/wiki/Swiss_cheese_model).
Imagine each layer of your security architecture as a slice of Swiss cheese. Every
layer has inherent flaws, misconfigurations, or operational blind spots: these are
the holes in the cheese. 

If your defensive layers rely on the exact same strategy (for example, stacking 
three firewalls from the same vendor), the holes in the cheese perfectly align. 
A single exploit will pierce straight through. Therefore, it is critical that defensive
tactics are uncorrelated and orthogonal. By combining entirely different control
mechanisms: such as physical separation, application-layer identity verification,
and deep packet inspection, you ensure the holes do not align. An adversary who 
bypasses a network control using a zero-day exploit will still be halted by an uncorrelated
identity control requiring a hardware token.

### **_Zero Trust as a Key Component_**

Zero Trust architecture is the modern catalyst for effective defence in depth. While
legacy models assumed that anything inside the corporate network was trustworthy,
Zero Trust operates on the assumption that the network is already compromised. It
acts as a continuous, ubiquitous layer of verification that does not rely on physical
network boundaries. By requiring explicit, continuous authorisation for every user,
device, and application, regardless of location, Zero Trust provides an entirely
uncorrelated layer of defence that complements traditional boundary controls perfectly.

### **_Key Activities and Posture Assessment_**

Implementing and assessing defence in depth requires continuous operational discipline
rather than a one-time installation. Key activities include:

 * **Comprehensive Asset Discovery**: You cannot layer defences around assets you
   do not know exist.
 * **Threat Modelling**: Identifying specific threat vectors to ensure diverse controls
   are applied where they are most needed.
 * **Layered Control Implementation**: Deploying a mix of administrative policies,
   physical security controls, and technical safeguards.

To assess your defence in depth posture, organisations must abandon self-attestation
in favour of rigorous, objective measurement. This involves conducting continuous
vulnerability assessments, executing regular penetration tests that specifically
attempt to chain exploits across different layers, and using structured frameworks
such as Agilicus’ Cyber Security Assessment Scorecard to identify where defensive
layers are dangerously correlated or missing entirely.

### **_Authoritative References_**

For further reading on the foundational principles of layered security, consult 
these authoritative sources:

 * **National Institute of Standards and Technology**: Measuring and Improving the
   Effectiveness of Defense-in-Depth Postures. A comprehensive analysis of how to
   objectively assess overlapping security controls. ([https://www.nist.gov/publications/measuring-and-improving-effectiveness-defense-depth-postures](https://www.nist.gov/publications/measuring-and-improving-effectiveness-defense-depth-postures))
 * **National Institute of Standards and Technology Glossary**: Defense in Depth.
   The definitive technical definition of layered security. ([https://csrc.nist.gov/glossary/term/defense_in_depth](https://csrc.nist.gov/glossary/term/defense_in_depth))
 * **Canadian Nuclear Safety Commission**: Defence in Depth. A practical look at
   how the philosophy of layered safety and security is applied in the most critical
   of physical environments, nuclear power generation. [(https://www.cnsc-ccsn.gc.ca/eng/reactors/power-plants/defence-in-depth/](http://(https://www.cnsc-ccsn.gc.ca/eng/reactors/power-plants/defence-in-depth/))
 * **Wikipedia**: Defence in Depth. An overview of how the military strategy was
   adapted into information systems security. ([https://en.wikipedia.org/wiki/Defence_in_depth](https://en.wikipedia.org/wiki/Defence_in_depth))
 * NIST Special Publication NIST SP 800-82r3 Guide to Operational Technology (OT)
   Security [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf)
 * [TSA Security Directive Pipeline-2021-02C (SD02C)](https://www.tsa.gov/sites/default/files/tsa_sd_pipeline-2021-02-july-21_2022.pdf)

## Appendix: **_Frequently Asked Questions_**

How do outbound-only reverse tunnels improve security?Outbound-only reverse tunnels
improve security by ensuring that no ports are open to the public internet. Instead
of a remote user connecting directly into the network, a secure connector inside
the environment initiates an outbound connection to a trusted proxy. This setup 
effectively hides the network from search engines and scanners, eliminates the vulnerabilities
associated

Outbound-only reverse tunnels improve security by ensuring that no ports are open
to the public internet. Instead of a remote user connecting directly into the network,
a secure connector inside the environment initiates an outbound connection to a 
trusted proxy. This setup effectively hides the network from search engines and 
scanners, eliminates the vulnerabilities associated with inbound port forwarding,
and works seamlessly across network address translation and non-public internet 
protocol environments. Learn more about the [advantages of an outbound-only network](https://www.agilicus.com/compare/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/how-do-outbound-only-reverse-tunnels-improve-security/)

How does Layer-7 analysis improve visibility in industrial networks?Layer-7 analysis
involves inspecting network traffic at the application layer to understand the specific
actions being performed, such as which files are being accessed or which commands
are being sent to a programmable logic controller. This provides much deeper visibility
than traditional firewall logging, which only sees the source and destination at
the network layer.

Layer-7 analysis involves inspecting network traffic at the application layer to
understand the specific actions being performed, such as which files are being accessed
or which commands are being sent to a programmable logic controller. This provides
much deeper visibility than traditional firewall logging, which only sees the source
and destination at the network layer. By monitoring these granular details in real
time, security teams can detect subtle anomalies that may indicate a sophisticated
attack in progress. Our [evolution guide](https://www.agilicus.com/from-tunnels-to-zero-trust-the-evolution-of-industrial-remote-access/)
explains this shift in visibility.

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/how-does-layer-7-analysis-improve-visibility-in-industrial-networks/)

How does administrative tool restriction harden industrial systems?Administrative
tool restriction limits the availability of powerful system utilities, such as PowerShell
and command-line interfaces, to only specifically authorised service accounts. Attackers
often "live off the land" by using these native tools to perform discovery, escalate
privileges, and execute malware. By restricting these tools and using application
whitelisting to block unauthorised executables, organisations can

Administrative tool restriction limits the availability of powerful system utilities,
such as PowerShell and command-line interfaces, to only specifically authorised 
service accounts. Attackers often “live off the land” by using these native tools
to perform discovery, escalate privileges, and execute malware. By restricting these
tools and using application whitelisting to block unauthorised executables, organisations
can significantly reduce the internal tools available to an adversary. Discover 
[system hardening techniques](https://www.agilicus.com/from-tunnels-to-zero-trust-the-evolution-of-industrial-remote-access/)
in our evolution guide.

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/how-does-administrative-tool-restriction-harden-industrial-systems/)

How does application-layer brokering prevent lateral movement?Application-layer 
brokering prevents lateral movement by connecting a user only to a specific application
or service, rather than dropping them directly onto a network subnet. In traditional
architectures, once a user is authenticated, they can often see and attempt to connect
to any device on the same local area network. By brokering at the application

Application-layer brokering prevents lateral movement by connecting a user only 
to a specific application or service, rather than dropping them directly onto a 
network subnet. In traditional architectures, once a user is authenticated, they
can often see and attempt to connect to any device on the same local area network.
By brokering at the application layer, the user remains isolated from the underlying
infrastructure, ensuring that an adversary cannot use a single compromised session
to scan the network for other vulnerable targets. Learn about [brokering vs. port forwarding](https://www.agilicus.com/compare/port-forwarding/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/how-does-application-layer-brokering-prevent-lateral-movement/)

How does machine-to-machine security protect industrial assets?Machine-to-machine
security focuses on securing the communication between devices, such as programmable
logic controllers and engineering workstations, without human intervention. Instead
of relying on static application programming interface (API) keys that can be stolen,
modern security frameworks use short-lived tokens and cryptographically bind identities
to specific hardware. This ensures that only authorised machines can talk

Machine-to-machine security focuses on securing the communication between devices,
such as programmable logic controllers and engineering workstations, without human
intervention. Instead of relying on static application programming interface (API)
keys that can be stolen, modern security frameworks use short-lived tokens and cryptographically
bind identities to specific hardware. This ensures that only authorised machines
can talk to one another, preventing rogue devices from injecting malicious commands.
Our [blueprint for industrial security](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/)
details these hardware-bound protections.

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/how-does-machine-to-machine-security-protect-industrial-assets/)

How does vendor federation simplify industrial access?Vendor federation allows third-
party technicians to use their own corporate identities to access specific resources
on your network. This eliminates the burden of creating and managing hundreds of
guest accounts and ensures that you do not have to store passwords for external 
users. By trusting the authentication performed by the vendor, you can focus on

Vendor federation allows third-party technicians to use their own corporate identities
to access specific resources on your network. This eliminates the burden of creating
and managing hundreds of guest accounts and ensures that you do not have to store
passwords for external users. By trusting the authentication performed by the vendor,
you can focus on granular authorisation—deciding exactly what they can do—while 
maintaining a high degree of security and auditability. See our [case study on vendor access](https://www.agilicus.com/case-studies/vpn-alternative-for-securing-remote-access-to-legacy-hmi-plc/)
for a real-world example.

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/how-does-vendor-federation-simplify-industrial-access/)

What are CIS Benchmarks and how do they apply to industrial security?CIS Benchmarks
are a set of globally recognised best practices for securing individual software
applications and operating systems. In an industrial security context, applying 
these benchmarks involves hardening workstations, servers, and network equipment
to a verified, secure standard. This includes disabling unnecessary services, closing
unused ports, and enforcing strong password policies. By following these vendor-
neutral

CIS Benchmarks are a set of globally recognised best practices for securing individual
software applications and operating systems. In an industrial security context, 
applying these benchmarks involves hardening workstations, servers, and network 
equipment to a verified, secure standard. This includes disabling unnecessary services,
closing unused ports, and enforcing strong password policies. By following these
vendor-neutral guidelines, organisations can establish a robust security baseline
for their entire operational technology estate. Learn about [hardening as part of boundary defence](https://www.agilicus.com/compare/port-forwarding/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-are-cis-benchmarks-and-how-do-they-apply-to-industrial-security/)

What are process zones in an industrial security context?Process zones are logical
groupings of assets that perform a similar function or belong to the same industrial
process. Defining these zones allows security teams to apply specific communication
policies, ensuring that devices within a zone can interact while traffic between
zones is strictly monitored and controlled. This architecture is a core component
of the

Process zones are logical groupings of assets that perform a similar function or
belong to the same industrial process. Defining these zones allows security teams
to apply specific communication policies, ensuring that devices within a zone can
interact while traffic between zones is strictly monitored and controlled. This 
architecture is a core component of the ISA/IEC 62443 standard for protecting industrial
automation and control systems. Read more in our [pragmatic blueprint for industrial security](https://www.agilicus.com/a-pragmatic-blueprint-for-industrial-cyber-security/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-are-process-zones-in-an-industrial-security-context/)

What are shadow perimeters in industrial environments?Shadow perimeters refer to
undocumented or unauthorised connections that bypass established security boundaries,
such as rogue cellular modems or vendor-installed wireless access points. These 
connections create invisible entry points into the operational technology network,
circumventing firewalls and monitoring tools. To maintain a secure posture, organisations
must perform physical and logical audits to identify and secure

Shadow perimeters refer to undocumented or unauthorised connections that bypass 
established security boundaries, such as rogue cellular modems or vendor-installed
wireless access points. These connections create invisible entry points into the
operational technology network, circumventing firewalls and monitoring tools. To
maintain a secure posture, organisations must perform physical and logical audits
to identify and secure these hidden entry points. Learn more about [securing boundaries in our strategic blueprint](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-are-shadow-perimeters-in-industrial-environments/)

What are the benefits of identity-aware logging?Identity-aware logging captures 
every user action and ties it directly to a verified identity, providing a complete
audit trail of who did what and when. In traditional industrial environments, logs
are often device-centric, showing that a connection was made from an internet protocol
address but not which specific person was responsible. By integrating identity into

Identity-aware logging captures every user action and ties it directly to a verified
identity, providing a complete audit trail of who did what and when. In traditional
industrial environments, logs are often device-centric, showing that a connection
was made from an internet protocol address but not which specific person was responsible.
By integrating identity into the logging process, organisations can quickly identify
and respond to suspicious activity and meet stringent regulatory requirements for
auditing and compliance. Read about [auditing in our configuration guide](https://www.agilicus.com/anyx-guide/site-firewall-configuration/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-are-the-benefits-of-identity-aware-logging/)

What are the benefits of unified identity for operational technology?Unified identity
centralises user credentials and access permissions into a single corporate directory,
such as Microsoft Entra or Google Workspace. This eliminates the need for fragmented,
local, or shared accounts across different industrial systems, which are difficult
to manage and secure. By using a single sign-on approach, organisations can enforce
global security policies and ensure

Unified identity centralises user credentials and access permissions into a single
corporate directory, such as Microsoft Entra or Google Workspace. This eliminates
the need for fragmented, local, or shared accounts across different industrial systems,
which are difficult to manage and secure. By using a single sign-on approach, organisations
can enforce global security policies and ensure that access is immediately revoked
when an employee or contractor leaves the company. Discover the [efficiency of unified access](https://www.agilicus.com/compare/port-forwarding/)
in our comparison.

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-are-the-benefits-of-unified-identity-for-operational-technology/)

What are the benefits of using an identity-aware proxy for remote access?An identity-
aware proxy provides a secure gateway that terminates remote sessions at the application
layer rather than the network layer. Unlike a traditional virtual private network
that often grants broad network access, an identity-aware proxy verifies the user
identity and specific permissions before allowing access to a single application
or resource. This prevents an infected

An identity-aware proxy provides a secure gateway that terminates remote sessions
at the application layer rather than the network layer. Unlike a traditional virtual
private network that often grants broad network access, an identity-aware proxy 
verifies the user identity and specific permissions before allowing access to a 
single application or resource. This prevents an infected remote device from moving
laterally across the network and ensures that access is strictly controlled and 
fully audited. See how this [evolves industrial remote access](https://www.agilicus.com/from-tunnels-to-zero-trust-the-evolution-of-industrial-remote-access/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-are-the-benefits-of-using-an-identity-aware-proxy-for-remote-access/)

What is configuration drift and why should I monitor it?Configuration drift is the
gradual deviation of a system's settings from its established, secure baseline due
to manual changes, software updates, or unauthorised modifications. Monitoring for
drift is essential because even small changes—such as an accidentally opened port
or a disabled security service—can create new vulnerabilities. By using automated
tools to detect and alert on

Configuration drift is the gradual deviation of a system’s settings from its established,
secure baseline due to manual changes, software updates, or unauthorised modifications.
Monitoring for drift is essential because even small changes—such as an accidentally
opened port or a disabled security service—can create new vulnerabilities. By using
automated tools to detect and alert on these changes, security teams can ensure 
that systems remain in a known, secure state. Our documentation on [maintaining secure configurations](https://www.agilicus.com/anyx-guide/site-firewall-configuration/)
provides further context.

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-is-configuration-drift-and-why-should-i-monitor-it/)

What is immutable infrastructure in an industrial setting?Immutable infrastructure
is a design principle where systems are replaced rather than updated or repaired.
In an industrial setting, this involves using read-only file systems for controllers
and workstations, ensuring that no permanent changes can be made to the software
once it is deployed. If a system is suspected of being compromised or requires an

Immutable infrastructure is a design principle where systems are replaced rather
than updated or repaired. In an industrial setting, this involves using read-only
file systems for controllers and workstations, ensuring that no permanent changes
can be made to the software once it is deployed. If a system is suspected of being
compromised or requires an update, it is simply rebuilt from a trusted, gold image.
This approach eliminates configuration drift and ensures that the environment always
returns to a known, secure state. See our [pragmatic blueprint for modern infrastructure](https://www.agilicus.com/a-pragmatic-blueprint-for-industrial-cyber-security/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-is-immutable-infrastructure-in-an-industrial-setting/)

What is least-privilege authorisation in operational technology?Least-privilege 
authorisation is a security principle where users and devices are granted only the
minimum level of access necessary to perform their specific functions. In an operational
technology environment, this means a technician might have read-only access to telemetry
data but no permission to change engineering configurations. By strictly limiting
access rights, organisations can prevent

Least-privilege authorisation is a security principle where users and devices are
granted only the minimum level of access necessary to perform their specific functions.
In an operational technology environment, this means a technician might have read-
only access to telemetry data but no permission to change engineering configurations.
By strictly limiting access rights, organisations can prevent accidental changes
and ensure that if a set of credentials is compromised, the potential damage is 
contained. See our [comparison of granular access vs. legacy methods](https://www.agilicus.com/compare/port-forwarding/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-is-least-privilege-authorisation-in-operational-technology/)

What is phishing-resistant multi-factor authentication?Phishing-resistant multi-
factor authentication uses hardware security keys and cryptographic protocols to
ensure that authentication cannot be intercepted or spoofed by an attacker. Unlike
traditional methods like short message service (SMS) codes or email-based notifications,
which can be vulnerable to social engineering and interception, hardware-based keys
require physical possession of a token. This is a critical

Phishing-resistant multi-factor authentication uses hardware security keys and cryptographic
protocols to ensure that authentication cannot be intercepted or spoofed by an attacker.
Unlike traditional methods like short message service (SMS) codes or email-based
notifications, which can be vulnerable to social engineering and interception, hardware-
based keys require physical possession of a token. This is a critical requirement
for protecting administrative access to critical infrastructure. You can read about
[implementing strong authentication](https://www.agilicus.com/from-tunnels-to-zero-trust-the-evolution-of-industrial-remote-access/)
in our evolution guide.

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-is-phishing-resistant-multi-factor-authentication/)

What is the Swiss Cheese Model in industrial cyber security?The Swiss Cheese Model
is a defensive strategy where multiple, distinct layers of security are stacked 
to ensure that no single point of failure leads to a systemic breach. Each layer,
whether it is a network boundary, an identity control, or system hardening, has 
inherent flaws, much like the holes in Swiss cheese. By ensuring

The Swiss Cheese Model is a defensive strategy where multiple, distinct layers of
security are stacked to ensure that no single point of failure leads to a systemic
breach. Each layer, whether it is a network boundary, an identity control, or system
hardening, has inherent flaws, much like the holes in Swiss cheese. By ensuring 
these layers are orthogonal and diverse, an adversary who bypasses one layer is 
still blocked by the next, significantly reducing the overall risk to operational
technology environments. You can learn more about how this applies to modern infrastructure
in our [pragmatic blueprint for industrial cyber security](https://www.agilicus.com/a-pragmatic-blueprint-for-industrial-cyber-security/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-is-the-swiss-cheese-model-in-industrial-cyber-security/)

What role does credential protection play in industrial security?Credential protection
involves implementing technical controls to prevent attackers from stealing or using
authentication data, such as passwords and tokens. In Windows environments, this
includes using features like Credential Guard and disabling outdated protocols like
NTLM to prevent "pass-the-hash" attacks. Protecting credentials is vital because
once an attacker has administrative access, they can often bypass

Credential protection involves implementing technical controls to prevent attackers
from stealing or using authentication data, such as passwords and tokens. In Windows
environments, this includes using features like Credential Guard and disabling outdated
protocols like NTLM to prevent “pass-the-hash” attacks. Protecting credentials is
vital because once an attacker has administrative access, they can often bypass 
other security layers to take full control of critical infrastructure. Our [best practices guide](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/)
explains these protection mechanisms.

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/what-role-does-credential-protection-play-in-industrial-security/)

Why is firmware integrity critical for industrial equipment?Firmware integrity ensures
that the software running on industrial controllers and devices has not been tampered
with or modified by an unauthorised party. Attackers may attempt to inject malicious
code into firmware during a supply chain attack or after gaining access to the network.
By verifying cryptographic signatures before installation and centrally managing
updates, organisations

Firmware integrity ensures that the software running on industrial controllers and
devices has not been tampered with or modified by an unauthorised party. Attackers
may attempt to inject malicious code into firmware during a supply chain attack 
or after gaining access to the network. By verifying cryptographic signatures before
installation and centrally managing updates, organisations can ensure that their
hardware only runs trusted, authorised code. Our [blueprint for industrial security](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/)
covers these supply chain protections.

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/why-is-firmware-integrity-critical-for-industrial-equipment/)

Why is identity considered the new air gap?In a zero trust architecture, identity
replaces the traditional, physical air gap as the primary line of defence. As industrial
networks become more interconnected, relying on physical isolation is no longer 
a viable strategy. Instead, robust authentication and authorisation ensure that 
only verified users and devices can access specific assets, regardless of their 
location. This

In a zero trust architecture, identity replaces the traditional, physical air gap
as the primary line of defence. As industrial networks become more interconnected,
relying on physical isolation is no longer a viable strategy. Instead, robust authentication
and authorisation ensure that only verified users and devices can access specific
assets, regardless of their location. This shift allows for secure remote access
while maintaining the rigorous control once provided by isolation. Our post on [modern identity strategies](https://www.agilicus.com/a-pragmatic-blueprint-for-industrial-cyber-security/)
explores this transition.

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/why-is-identity-considered-the-new-air-gap/)

Why is internal encryption necessary for east-west traffic?Internal encryption ensures
that all communication within a network, often referred to as east-west traffic,
is cryptographically protected from sniffing and interception. In many industrial
environments, data is sent in plain text once it passes the perimeter, allowing 
an attacker who has gained internal access to capture sensitive administrative credentials
or process data. By using

Internal encryption ensures that all communication within a network, often referred
to as east-west traffic, is cryptographically protected from sniffing and interception.
In many industrial environments, data is sent in plain text once it passes the perimeter,
allowing an attacker who has gained internal access to capture sensitive administrative
credentials or process data. By using a managed internal certificate authority to
encrypt all traffic between internal assets, you ensure that every session remains
private and secure. See our [blueprint for encrypting internal traffic](https://www.agilicus.com/a-pragmatic-blueprint-for-industrial-cyber-security/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/why-is-internal-encryption-necessary-for-east-west-traffic/)

Why is network micro-segmentation necessary for operational technology?Network micro-
segmentation involves dividing an industrial network into small, isolated zones 
based on functional requirements. This prevents a breach in one area, such as a 
building management system, from spreading to more critical assets like a water 
treatment process. By enforcing security policies at the individual asset level,
organisations can create granular boundaries that block

Network micro-segmentation involves dividing an industrial network into small, isolated
zones based on functional requirements. This prevents a breach in one area, such
as a building management system, from spreading to more critical assets like a water
treatment process. By enforcing security policies at the individual asset level,
organisations can create granular boundaries that block lateral movement by attackers.
Learn about the [technical implementation of logical zones](https://www.agilicus.com/anyx-guide/site-firewall-configuration/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/why-is-network-micro-segmentation-necessary-for-operational-technology/)

Why should I eliminate inbound ports in my operational technology network?Eliminating
inbound ports is a critical step in reducing the attack surface of an operational
technology network. Traditional remote access often relies on open listeners or 
legacy virtual private networks, which make internal systems visible to automated
scanners and malicious actors on the public internet. By replacing these with outbound-
only reverse tunnels, you render the

Eliminating inbound ports is a critical step in reducing the attack surface of an
operational technology network. Traditional remote access often relies on open listeners
or legacy virtual private networks, which make internal systems visible to automated
scanners and malicious actors on the public internet. By replacing these with outbound-
only reverse tunnels, you render the internal environment invisible to external 
threats while still allowing secure, authenticated access for authorized users. 
You can find more details on our [comparison of identity-aware access and port-forwarding](https://www.agilicus.com/compare/port-forwarding/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/why-should-i-eliminate-inbound-ports-in-my-operational-technology-network/)

Why should legacy protocols like RDP be eradicated from internal networks?Legacy
protocols such as remote desktop protocol (RDP), server message block (SMB), and
Telnet were not designed with modern security threats in mind and are frequently
exploited by ransomware to spread across networks. These protocols often lack robust
encryption and multi-factor authentication, making them prime targets for lateral
movement. Eradicating these from internal subnets and

Legacy protocols such as remote desktop protocol (RDP), server message block (SMB),
and Telnet were not designed with modern security threats in mind and are frequently
exploited by ransomware to spread across networks. These protocols often lack robust
encryption and multi-factor authentication, making them prime targets for lateral
movement. Eradicating these from internal subnets and replacing them with secure,
identity-aware proxies significantly hardens the environment. See how we [evolve past legacy protocols](https://www.agilicus.com/from-tunnels-to-zero-trust-the-evolution-of-industrial-remote-access/).

For more information, see [Industrial Cyber Security Best Practices](https://www.agilicus.com/white-papers/industrial-cyber-security-best-practices/).

[Permalink](https://www.agilicus.com/faq/why-should-legacy-protocols-like-rdp-be-eradicated-from-internal-networks/)

BOOK A MEETING

Ready To Learn More?

Agilicus AnyX Zero Trust enables any user, on any device, secure connectivity to
any resource they need—without a client or VPN. Whether that resource is a web application,
a programmable logic controller, or a building management system, Agilicus can secure
it with multi-factor authentication while keeping the user experience simple with
single sign-on.

[BOOK A MEETING](https://www.agilicus.com/book-calendar-meeting/)

![Agilicus AnyX platform logo, horizontal orientation.](https://www.agilicus.com/
www/9f758437-agilicus-logo-horizonta.svg)

info@agilicus.com, +1 ‪519 953-4332‬

300-87 King St W, Kitchener, ON, Canada. N2G 1A7

[⌊partner⌉⌊partner⌉[