Security Engineering · Topic 6 of 8
Specialized and Legacy Systems
Secure ICS, SCADA, OT, IoT, embedded and legacy systems with segmentation, compensating controls, passive monitoring and clear risk acceptance.
- 5 min
- Includes a diagram
- OT and ICS put safety and availability ahead of confidentiality.
- Many industrial protocols have no authentication, so network controls must compensate.
- Segment OT from IT, and follow the Purdue model idea of restricted flows between layers.
What it is
Specialized systems are built for a single purpose and often run for decades. They include industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, operational technology (OT), Internet of Things (IoT) devices, embedded devices, real time operating systems (RTOS) and medical equipment.
They share a problem: they cannot be patched, scanned or rebooted like office computers, and many were designed with no security. The task is to reduce risk around them using controls that do not disturb the function they perform.
How it works
Why these systems differ
| Feature | Typical IT system | Typical OT or embedded system |
|---|---|---|
| Top priority | Confidentiality | Safety and availability |
| Life span | Years | Often decades |
| Patching | Regular | Rare, needs an outage window and vendor approval |
| Protocols | Authenticated, encrypted | Often plain text, no authentication |
| Tolerance for scanning | Usually fine | Active scans can crash controllers |
An ICS controls physical processes such as pumps, valves and motors. A programmable logic controller (PLC) runs the control logic, a human machine interface (HMI) lets operators view and command the process, and SCADA coordinates remote sites. Many older industrial protocols, such as Modbus and Distributed Network Protocol 3 (DNP3), were designed for trusted networks and traditionally lack strong authentication.
Network architecture for industrial systems
The Purdue model describes layers from field devices and controllers at the bottom up to business systems at the top. The principle is to restrict traffic between layers. The business network should not talk directly to controllers, and a demilitarized zone between IT and OT holds the few shared services, such as historian data copies and patch staging.
- Segment OT from IT with firewalls that allow only known protocols and flows.
- Use a jump host with multi factor authentication for remote vendor access, and log it.
- Prefer a data diode, a hardware one way link, where data must only leave a critical network.
- Do not rely on an "air gap" alone. Removable media, laptops and maintenance connections often bridge it.
Securing what cannot be patched
When a device cannot be patched, add controls around it.
| Control | Purpose |
|---|---|
| Segmentation and strict allow lists | Limit who can talk to the device |
| Virtual patching | An intrusion prevention system or firewall blocks traffic that would exploit a known flaw |
| Application allow listing | Only approved code runs on supporting hosts |
| Passive network monitoring | Detects abnormal commands without sending traffic to fragile devices |
| Disabling unused services and ports | Shrinks the attack surface |
| Physical protection | Locks and cages, since many devices have no login at all |
| Backups of configuration and logic | Quick restore after tampering or failure |
Embedded, IoT and medical devices
IoT devices often ship with default credentials, open services and no update path. Change defaults, place them on a separate network, restrict outbound access to what they need, and track them in an inventory. Choose products that have a vendor support commitment and a way to update firmware securely.
Medical and safety critical equipment may be regulated, so changes need vendor involvement. A patch that breaks a certified function can have patient safety consequences, which is why isolation is the usual answer.
System on chip
A system on chip (SoC) places the processor, memory, input and output controllers, and often radios such as Wi-Fi and Bluetooth on one chip. It is common in phones, IoT devices and appliances.
It is hard to patch or inspect because the pieces cannot be swapped or examined separately, and updates depend on the vendor, who may stop supporting it. Watch for these risks.
- Secure boot: the trust chain depends on keys held in the chip, and weak or disabled settings allow unsigned code.
- Debug ports: interfaces such as UART and JTAG left enabled in production give direct access.
- Radios: each wireless interface adds attack surface.
Choose products with a vendor support commitment, enable secure boot, disable debug access, and isolate the devices on the network.
Legacy systems
Legacy systems run unsupported operating systems or applications. Options in order of preference are to replace or upgrade, to obtain extended support from the vendor, to virtualize and isolate, or to accept the risk with compensating controls and a documented review date. Reducing exposure, such as removing internet access, often delivers most of the benefit quickly.
Document the business reason, the compensating controls, an owner, and a planned retirement date, so the exception does not become permanent.
What to remember for the exam
- OT and ICS put safety and availability ahead of confidentiality.
- Many industrial protocols have no authentication, so network controls must compensate.
- Segment OT from IT, and follow the Purdue model idea of restricted flows between layers.
- Prefer passive monitoring in fragile environments, and avoid active scanning.
- Virtual patching and allow listing protect systems that cannot be patched.
- A data diode enforces one way data flow in hardware.
- Air gaps are bridged by removable media and maintenance laptops, so control those paths.
- Legacy risk acceptance needs compensating controls, an owner and a review date.
When a question describes an unpatchable controller on a flat network, the first answer is segmentation with a firewall allowing only required flows.
Common mistakes
Running a vulnerability scan against a controller. Active scanning can crash it. Use passive discovery or a test copy.
Applying IT patch rules to OT. Patching needs vendor testing and a planned outage window.
Trusting the air gap. Physical media and vendor laptops cross it, so scan them and control their use.
Ignoring physical security. Many devices have no authentication, so a locked room is the control.
Changing a configuration on a safety system without vendor and operations approval can create a hazard, so follow change control.
Check yourself
Work through these three questions.
Why is active vulnerability scanning risky on industrial controllers?
Fragile devices may crash or misbehave when probed, so passive monitoring is preferred.
What does a data diode do?
It enforces one way data flow in hardware, so data can leave a protected network but nothing can come back in.
What should accompany risk acceptance for a legacy system?
Compensating controls, a named owner, a documented reason and a review or retirement date.
Topic 6 of 8 in Security Engineering
Test yourself on Security Engineering
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.