Chapter 76 — IoT, OT, embedded, and physical-world security
In one sentence
IoT and OT security are security engineering with physical consequences, long-lived devices, fragile update paths, and protocols that were often built for trusted networks.
Why the risk model changes
- devices may run for 10–30 years;
- patch windows may be rare or impossible;
- downtime can mean safety, production, or revenue impact;
- protocols may lack authentication/encryption;
- asset owners may not know every device exists;
- scanning can break fragile systems;
- "just install EDR" is often impossible.
Review checklist
| Area | Questions |
|---|---|
| Asset inventory | What exists, firmware version, owner, network location? |
| Network segmentation | Can office IT reach plant/control networks directly? |
| Remote access | VPN/MFA/jump host/session recording/vendor access expiry? |
| Updates | Signed firmware? rollback? maintenance windows? |
| Default credentials | Removed, rotated, monitored? |
| Protocol exposure | Modbus, BACnet, DNP3, MQTT, UPnP, proprietary services? |
| Safety | What happens if control fails open/closed? |
| Logging | Can you see commands, config changes, remote access? |
Scenario: building-management system exposed through VPN
An HVAC vendor has VPN access to a building-management network. The same network can reach corporate file servers. Vendor credentials are reused and lack MFA.
Real fix:
- vendor access through a broker/jump host;
- MFA and named accounts;
- time-bound access approvals;
- segmentation between BMS and corporate network;
- monitoring of remote sessions and controller changes;
- tested incident plan that includes facilities/operations, not just IT.
Common mistakes
- Running aggressive vulnerability scans against fragile controllers.
- Treating OT as "old IT."
- Ignoring vendor remote access.
- Designing controls that require downtime the plant cannot accept.