Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure a connected factory by reducing unnecessary internet exposure, separating operational technology (OT) from office IT, tightly governing remote maintenance, maintaining an accurate asset inventory, monitoring industrial traffic, and rehearsing recovery that protects both production and safety. Make every change through an impact analysis: a control that improves cyber security but stops a process or defeats a safety function is not a finished solution.
This guide lays out an implementation sequence for controllers, HMIs, engineering workstations, gateways, sensors, industrial IoT (IIoT) devices, and their support connections. It follows the risk and architecture priorities in current Cybersecurity and Infrastructure Security Agency (CISA) guidance, including its Internet Exposure Reduction Guidance published June 4, 2025.
What “secure” means in a connected factory
Factory security is not simply installing antivirus on a workstation or placing a VPN in front of a controller. OT and industrial control system (ICS) environments have different consequences from ordinary enterprise networks: an unauthorized command can damage equipment, create an unsafe condition, spoil a batch, or stop a line. Availability, process integrity and personnel safety therefore have to be considered alongside confidentiality.
IIoT expands the attack surface through sensors, gateways, programmable logic controllers (PLCs), distributed control systems, historians, HMIs, engineering laptops, vendor appliances and cloud or enterprise integrations. Proprietary protocols and old operating systems do not make a flat network trustworthy. The practical objective is to make every path deliberate: identify the asset, define who may communicate with it, authenticate the person or service, observe the connection and retain a safe way to operate if a security control or network link fails.
#1 Best Overall
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition
- ABIS BOOK
- Packt Publishing
Before changing routing, filtering, firmware or authentication, document the process impact and obtain approval from operations and safety owners. CISA’s ICS Recommended Practices collection repeatedly points to risk-informed decisions and impact analysis rather than one-size-fits-all controls.
1. Inventory equipment and map the flows it depends on
You cannot segment or monitor what you have not identified. Start with a living inventory, then draw the data and control paths that keep each production function running.
Record the asset details that affect security decisions
- Device role: PLC, safety controller, HMI, engineering workstation, historian, sensor, gateway, remote-access appliance or network infrastructure.
- Manufacturer, model, serial number, site and physical location.
- Operating system, firmware, application and protocol versions.
- Asset owner, process owner, support contact and vendor support status.
- Safety or production function, criticality and the consequence of loss, manipulation or delayed operation.
- Authentication method, local accounts, service accounts and the people or suppliers authorized to use them.
- Required inbound and outbound communications, including destination, protocol, port, schedule and reason.
- Internet exposure, wireless or cellular links, removable-media use and any connection to an enterprise or cloud service.
Map dependencies before enforcing boundaries
Build a zone-and-conduit diagram that shows controllers, HMIs, engineering stations, supervisory servers, historians, safety systems, plant services, business systems and remote-access paths. Trace dependencies in both directions. For example, a historian may export production data to an enterprise system while an engineering workstation needs a controlled path to a PLC only during approved maintenance. Record whether a function can operate locally or manually if that path is unavailable.
Recommended Free Tools
Validate the map with controls engineers, electricians, network staff, maintenance and safety personnel. Passive discovery can find devices that procurement records miss, but confirm findings with process owners before labeling a device safe to block. CISA’s monitoring guidance calls for an updated inventory of critical assets; treat the inventory as an operational record with a named owner and a review trigger whenever equipment, firmware or a vendor connection changes.
2. Remove unnecessary internet exposure
Direct internet access is avoidable risk for most controllers and plant devices. CISA’s Internet Exposure Reduction Guidance (June 4, 2025) warns: “Many organizations unknowingly leave common vulnerabilities and weaknesses exposed to the internet, making them easy targets for exploitation.” Search firewalls, routers, cellular gateways, cloud consoles and vendor portals for public addresses, port forwards and management services that are not required.
Exposure-reduction procedure
- Export current perimeter rules and public DNS records. Match every exposed address or service to an owner and documented business need.
- Remove direct routes to controllers, HMIs, PLC programming interfaces and other control devices. Prefer an authenticated intermediary rather than a public management interface.
- Disable unused services, protocols, accounts and port forwards. Replace default passwords with unique credentials stored and governed according to site policy.
- Patch supported internet-facing systems on a risk-informed schedule. If a device is beyond vendor support, plan replacement; until then, reduce its reachable paths and increase monitoring.
- For a service that must remain reachable, place it behind a monitored jump host or equivalent controlled gateway, restrict source and destination, monitor ingress and egress, and enable multifactor authentication (MFA) where the technology supports it.
- Recheck exposure after firewall, remote-access, cloud or cellular changes. Keep evidence of the rule owner, review date and expiry for temporary access.
Do not assume that hiding an address or using a nonstandard port is protection. The control is a documented boundary with authentication, least privilege and monitoring. Internet exposure and remote maintenance are separate decisions: a supplier may need time-limited access without any plant device being directly reachable from the public network.
3. Segment OT/ICS around operational boundaries
Segmentation limits the blast radius of a compromised workstation, vendor account or IIoT gateway. Put OT behind firewalls and separate it from office IT and the public internet. Where data must cross trust levels, use a controlled intermediary zone—often called an industrial DMZ or perimeter network—rather than allowing business systems to initiate arbitrary sessions into control networks.
Design zones from the process, not from convenience
- Enterprise zone: business applications and user devices that should not directly manage controllers.
- Industrial DMZ: brokers, jump hosts, patch staging, historians or file-transfer services that mediate approved exchanges.
- Control zones: cells, lines or process areas containing PLCs, HMIs and engineering stations with similar availability and trust requirements.
- Safety-related areas: systems requiring additional separation and carefully reviewed maintenance paths according to the site’s hazard analysis.
Write an allow-list for every conduit
For each boundary, specify the source asset, destination asset, protocol, port, direction, purpose, schedule and owner. Default-deny rules are useful only when the exception list is complete and maintained. Filter industrial protocols at zone boundaries where the firewall technology can do so without violating timing or availability requirements. Log denied and permitted connections in a way that operations can review.
Segment further when a shared compromise would affect unrelated lines or safety functions. Conversely, do not insert a security appliance into a deterministic control loop without testing its latency, fail-open or fail-closed behavior and recovery procedure. The port numbers and mitigations in CISA’s Rockwell Automation MicroLogix 1100 advisory (ICSA-21-189-01) apply to that named product and context; they are not a universal rule set for another factory.
4. Make remote maintenance a controlled exception
Remote access should exist only for an approved task, an identified person or service, a defined time window and a logged session. A VPN may be one component, but CISA notes that VPN products can contain vulnerabilities and are only as secure as the devices connected through them. Keep the software current and do not treat a VPN tunnel as a substitute for authorization, segmentation or endpoint security.
Remote-access workflow
- Approve the need. Record the work order, affected assets, supplier or employee, requested dates and the operational owner who accepts the risk.
- Use a managed entry point. Terminate access at a hardened jump host or gateway in the intermediary zone; do not expose a PLC or HMI directly.
- Verify identity and device. Require MFA where possible, individual accounts, a managed endpoint, current security updates and malware protection appropriate to the environment. Prohibit shared credentials.
- Limit scope. Permit only the named destination, protocol and commands needed for the task. Separate viewing, configuration and programming privileges.
- Set an expiry. Grant access for the shortest practical window, with automatic disablement at the end. Remove dormant supplier accounts and old port forwards.
- Supervise the session. Log authentication, source device, commands or screen activity where technically and legally appropriate. Have an on-site operator observe changes that could affect safety or production.
- Close and review. Revoke the account or rule, confirm configuration changes, preserve logs and have the asset owner verify normal operation.
Maintain a list of every third-party connection, its owner, last use and emergency revocation method. Test revocation before an incident; a control that cannot be disabled quickly is not a dependable emergency control.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors5. Patch and maintain devices without creating a production outage
OT patching is a risk decision, not a race to install every update. Prioritize a vulnerability by exposure, exploitability, the asset’s process and safety impact, vendor support, available mitigations and the feasibility of testing. CISA’s recommended practices advise impact analysis before deployment.
Use a repeatable maintenance cycle
- Track vendor security advisories, support dates, firmware versions and dependencies in the inventory.
- Classify the asset’s exposure and consequence. An internet-facing gateway and an isolated, noncritical sensor do not require identical treatment.
- Obtain release notes, compatibility information and a rollback method. Test in a representative lab, spare line or maintenance window when feasible.
- Coordinate the change with operations, safety, quality and the vendor. Define abort criteria and who can return the system to its previous state.
- Verify backups, controller programs, recipes, configurations and license information before changing firmware or software.
- Deploy in a controlled sequence, observe process values and alarms, and record the result and remaining risk.
When a patch cannot be applied
Do not silently accept an unfixable vulnerability. Ask the manufacturer for a mitigation, then compensate by removing reachable paths, disabling unnecessary services, restricting accounts, placing the asset behind a stronger boundary and increasing monitoring. Document the reason, owner, review date and replacement plan. Unsupported equipment should be treated as a lifecycle risk, not as permanently exempt from security expectations.
6. Monitor industrial traffic and configuration changes
Enterprise logs alone rarely show whether a PLC is receiving an unusual write command or an engineering station has started talking to an unexpected cell. Choose monitoring that understands the site’s industrial protocols and can operate without disrupting deterministic traffic. CISA’s Considerations for ICS/OT Cybersecurity Monitoring Technologies (January 2023) emphasizes asset discovery, normal-traffic baselines and ICS-aware analysis.
Establish a baseline before tuning alerts
- Expected devices, addresses, roles, services and industrial protocols in each zone.
- Normal communication pairs, direction, frequency and maintenance windows.
- Authorized programming stations, firmware versions and configuration-change procedures.
- Normal use of remote-access gateways, removable media and data exports to enterprise systems.
Alert on changes that matter to operations
- Unknown assets or a device appearing in a protected zone.
- Unexpected connections across an OT/IT boundary or a new external destination.
- PLC logic, firmware, set-point or configuration changes outside an approved work order.
- New services, unnecessary ports, repeated authentication failures or unusual protocol commands.
- Traffic patterns associated with known malicious activity, scanning or lateral movement.
Send alerts to people who can interpret process context, not only to a generic security queue. Retain the network, authentication and configuration evidence needed to reconstruct an event, while respecting storage, privacy and safety requirements. Validate that sensors fail in a way that does not stop a safe process if the monitoring platform or its link becomes unavailable.
Rank #4
7. Control physical and removable-media paths
A locked-down network can still be bypassed through a maintenance laptop, programming cable, USB drive, wireless bridge or an unlocked controller cabinet. Restrict physical access to control equipment, lock cabinets where appropriate, and keep programming devices under accountable custody. Apply site procedures for visitor access and escorting vendors.
Scan removable media before it enters an isolated network using a process that does not connect the media to an unsafe system. Use approved transfer stations, write protection or other controls required by the equipment manufacturer. Record who supplied the media, what was scanned, which files were transferred and where the media is stored. Never improvise a removable-media procedure that could interrupt a safety function or corrupt a controller.
8. Prepare to detect, contain and recover from disruption
Incident response in a plant must answer operational questions as well as technical ones: who may isolate a line, who approves a shutdown, how a safety function is preserved, and how production resumes. Write these decisions before an emergency.
Build the response playbook
- Define severity levels for suspicious access, loss of view, loss of control, unsafe behavior and ransomware.
- List 24-hour contacts for operations, safety, engineering, IT, security, leadership, vendors and emergency services.
- Document isolation actions by zone, including which links can be disconnected without defeating a safety system.
- Specify evidence handling: preserve logs, controller programs, memory captures and relevant removable media without altering them unnecessarily.
- Define communications, regulatory or contractual notifications and the decision owner for restoring a connection.
- Document manual, local or fallback operation for critical functions and the conditions under which it is safe.
Keep secure offline copies of controller logic, HMI projects, configurations, network diagrams, software installers, licenses and recovery credentials. Test that backups are complete and restorable on equipment or a representative system. CISA’s #StopRansomware Guide supports offline backups and practiced recovery; in an OT setting, add process and safety checks before returning equipment to service.
9. A practical implementation sequence
Most sites should execute the work in the following order. Each stage produces information needed by the next, and each change should pass an operational-impact review.
| Stage | Primary work | Evidence of completion |
|---|---|---|
| Discover | Inventory assets, owners, support status, dependencies and remote paths. | Approved asset register and zone/data-flow diagram. |
| Expose less | Remove direct internet access, defaults, unused services and obsolete forwards. | Reviewed perimeter rules, exposure list and documented exceptions. |
| Separate | Place firewalls at OT boundaries, establish an intermediary zone and allow only required flows. | Rule matrix with owners, purpose, direction and review dates. |
| Govern access | Move maintenance through a managed gateway; enforce MFA, endpoint requirements, expiry and logging. | Approved access records and a tested revocation procedure. |
| Maintain | Prioritize patches, mitigations and replacements using exposure and operational impact. | Change records, test results, rollback plans and accepted residual risks. |
| Observe | Baseline industrial traffic and alert on unknown assets, cross-zone anomalies and unauthorized changes. | Tuned detections routed to an accountable response team. |
| Recover | Protect offline backups, rehearse isolation and validate manual or fallback operation. | Exercise report with corrective actions and verified restores. |
10. How to evaluate a firewall, gateway or monitoring approach
There is no universally correct appliance or architecture. Compare candidates against the site’s protocols, timing, availability and support model rather than selecting on feature count. An industrial Ethernet firewall may be appropriate at a cell boundary, but qualified OT engineering input is needed to verify protocol handling, reliability, safety impact and vendor support.
| Evaluation axis | Questions to answer |
|---|---|
| Operational and safety impact | Can it be deployed, upgraded or isolated without interrupting a process or defeating a safety function? What is the tested failure behavior? |
| Boundary strength | Does it enforce the intended zones and least-privilege flows, with usable rule review and logging? |
| Industrial compatibility | Does it understand the required protocols, timing, multicast or legacy behavior without unsafe latency? |
| Remote-access governance | Can it require approval, MFA, managed endpoints, time limits, session records and rapid revocation? |
| Visibility and response | Can it discover assets, baseline traffic, identify anomalous flows and export evidence to the response process? |
| Lifecycle support | Are security advisories, patches, replacement parts, support dates and qualified service personnel available? |
| Failure behavior | What happens to production and safe operation if the device, power, link, license or monitoring service fails? |
11. Common mistakes and how to correct them
“The equipment is proprietary, so it is safe.”
Proprietary protocols can still be reached through stolen credentials, exposed gateways, engineering laptops or vendor tools. Apply the same inventory, boundary and monitoring discipline as you would to familiar IT systems.
“A VPN solves remote access.”
A tunnel can extend an attacker’s reach if the user device, account or internal routes are compromised. Terminate access at a controlled gateway, restrict destinations, require MFA where possible, log sessions and expire permissions.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match“Patch everything immediately.”
An untested firmware change can stop a line or create unsafe behavior. Use representative testing, rollback plans and operations approval; compensate and document when immediate patching is not safe.
“We installed a sensor, so monitoring is finished.”
Visibility without a baseline produces noise. Identify expected devices and flows, tune industrial-protocol detections with process owners and connect alerts to people authorized to isolate equipment.
“The diagram is accurate because it was accurate last year.”
Temporary vendor links, new cells and cloud integrations age diagrams quickly. Make inventory and flow review part of change management and remote-access approval.
“Backups exist, so recovery is guaranteed.”
A backup that cannot be restored on compatible equipment is not a recovery capability. Keep protected offline copies, retain the software and credentials needed to use them, and exercise restoration with operations and safety checks.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →12. Questions to settle with plant leadership and vendors
- Which production and safety functions must remain available during a cyber incident, and who can authorize a shutdown?
- Which assets are unsupported, publicly reachable or dependent on a single vendor connection?
- What communications are genuinely required across each zone, and who owns every exception?
- Can the site revoke every remote account and path quickly, including emergency vendor access?
- Which industrial protocols and configuration changes can current monitoring interpret?
- When was the last restore, isolation and manual-operation exercise, and what corrective work remains?
Answering these questions turns security controls into an operating model: known assets, intentional boundaries, accountable access, safe maintenance, useful detection and practiced recovery.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
