What is a compensating control for legacy OT systems?

It is a measure that reduces a risk you cannot remove at its source. When a controller cannot be patched, has no password or runs an unsupported system, you protect it from outside instead: segmentation and firewall rules so that only named hosts can reach it, no internet access, a controlled remote-access path, locked cabinets, offline backups of programs and configurations, and monitoring that tells you when the protection is bypassed. Auditors working with IEC 62443 or NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. risk management generally expect such controls to be documented: which risk, which measure, who owns it and how you check that it still works. Monitoring is the part that produces that checking evidence. NetSenX can provide it: from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port it shows who talks to the legacy system and, from the Pro plan, raises OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. alerts for unauthorised writes, traffic crossing plant network levels, off-hours activity and S7comm commands.

← All 50 questions on OT and IoTAll topics