Everything Old Is New Again: Protecting Legacy Systems with Modern Security

### Overview In this panel discussion, cybersecurity and operational technology (OT) experts explore the realities of securing legacy industrial control systems (ICS). Combining nearly a century of cumulative experience across semiconductor manufacturing, food and agriculture, water and wastewater, and maritime operations, the panel examines why traditional IT security mindsets often fail in physical, plant-floor environments. They discuss practical security strategies, workforce dynamics, economics, and architectural approaches to safeguarding legacy devices without compromising human safety or halting operational production.

### Key Topics - **IT vs. OT Mindset & Life Safety**: In IT environments, security focuses on data confidentiality and integrity. In OT, priority lies in human life safety, environmental safety, and continuous production uptime. Disruptive IT controls like standard multi-factor authentication (MFA) can impede emergency response or manufacturing workflows. - **Economic and Accounting Barriers**: Factory managers often resist patching and upgrades due to the direct impact on product margin, yield, and factory output. The panel highlights the necessity of working with accounting guidelines (GAAP) to capitalize security investments and labor rather than absorbing disruptive in-period expenses. - **Operational Realities & Circumvention**: When security controls slow production or fail to account for the physical environment (such as cleanroom or chemical suits requiring gloves), operators will circumvent or unplug them. Pragmatic adaptations—such as using barcode scanners instead of keyboard passwords—are necessary. - **Workforce and Knowledge Preservation**: Securing legacy systems requires deep operational context. Decades of institutional knowledge are often held by seasoned operators. Recruiting and cross-training factory technicians into security roles builds credibility and operational alignment. - **Patching and Vulnerability Management**: Unvetted patching in OT environments can break downstream programmable logic controllers (PLCs) or associated hardware. Rigorous testing and staged rollouts during scheduled maintenance windows are essential.

### Technical Details - **Architectural Isolation**: Modernizing legacy OT relies heavily on network segmentation, the Purdue model, access control lists (ACLs), and VLANs. In cases where operating systems cannot be replaced (e.g., legacy systems running DOS, Windows 95, NT, or XP), virtualization and strict isolation keep systems functional while limiting exposure. - **Physical & Boundary Controls**: Before relying on internal software tools, physical protections (e.g., dedicated badge stations and perimeter device-scanning kiosks) prevent uninspected third-party hardware from entering the plant floor. - **Management Tool Risks**: Introducing visibility and asset-monitoring tools can inadvertently create new attack surfaces. Third-party risks and administrative access on centralized monitoring agents must be strictly governed. - **Standards and Frameworks**: OT third-party risk assessments must remain separate from IT evaluations. The panel points to standards such as IEC 62443, semiconductor standards SEMI E187 and SEMI E188, and the Purdue model to evaluate segmentation and cybersecurity posture.

### Takeaways Securing legacy operational systems does not require completely overhauling operational infrastructure or "boiling the ocean." Organizations should prioritize protecting life safety and environmental controls first, followed by business output. Security leaders must engage plant-floor staff, design frictionless controls tailored to physical operations, capitalize labor and security investments through financial planning, and establish robust manual failover and incident response procedures.