Legacy OT systems are susceptible to cyberattacks as they were not built with security in mind and often lack security by design. These systems are essential to sectors like Oil and Gas, Maritime, and Energy, where their security is challenging due to an antiquated technology or a mismatch between old and new technologies and a lack of visibility. It’s crucial to strike a balance between protecting the infrastructure from cyber attacks and the requirement for operational continuity. Here are some challenges we have seen in securing legacy OT systems:

1. Outdated hardware and software – The security of legacy OT systems is severely compromised by outdated hardware and software, making it challenging to obtain security fixes or updates. Integrating historical systems with new security technology may lead to compatibility problems.

2. Insecure communication protocols – Legacy OT systems may employ communication protocols that are not secure by today’s standards. These protocols might not be encrypted or might utilise insecure encryption techniques. Outdated OT systems often do not verify endpoints, allowing easy unauthorised access to the system.

3. Poor security awareness – Many organisations might not fully comprehend the dangers posed by legacy OT systems or might not have the specialised staff needed to maintain and safeguard these systems. Also, the security of the company may be seriously compromised by workers’ lack of security knowledge when using these technologies.

4. Inadequate encryption – The lack of encryption features in many legacy OT systems results in making them susceptible to cyber attacks. Due to the unique nature of the systems and the possibility of system outages during the deployment process, implementing encryption for these systems might be challenging. Furthermore, outdated OT systems sometimes employ outdated encryption techniques that do not adhere to current security norms. As a result, these systems may be vulnerable to attacks that make use of more recent and sophisticated encryption-cracking methods, this often leads to a false sense of security.

5. Proprietary protocols – Connecting legacy OT systems with new security solutions is challenging because they frequently employ proprietary protocols. This may make it difficult to put security measures in place, making it difficult for businesses to improve their outdated OT systems without spending a lot of money on new hardware and software. The use of devices supporting a lot of protocols often increases the attack surface.

6. Complexity of integration – Due to the complexity of their design and the proprietary nature of their protocols, legacy OT systems may be difficult to integrate with current security solutions. These systems did not require other systems to be integrated into them in order to function. As a result, combining legacy OT systems with new security solutions can be difficult and expensive.

7. Lack of visibility – Legacy OT systems may not facilitate the visibility required to detect and respond to cyber threats. These systems by design were operated in an isolated manner, without the need for constant monitoring or remote access. Hence, legacy OT systems may not have appropriate logging and monitoring capabilities to detect cyber threats.

In conclusion, protecting historical OT systems is a complex task that needs a comprehensive strategy. To stop cyberattacks that might cause serious operational and financial harm, organisations must be proactive in discovering and fixing vulnerabilities. Organisations can safeguard their vital infrastructure from cyber attacks by developing a comprehensive strategy to safeguarding legacy OT systems. This process may however require external support from organiastions with specific knowledge and experience in this area.