Treating every PLC and HMI as a Zero Trust endpoint can quickly overwhelm operations support. Legacy firmware and fixed traffic often reject IT agents or untested policy changes.
Zero trust works without changing PLCs
Zero Trust can work in OT when controls sit around critical assets, not inside them. PLCs and HMIs often cannot run endpoint agents or handle MFA prompts. They may also fail when inspection adds delay. Protect the routes to those devices instead.
Assets that should not receive agents
PLCs, safety controllers, older HMIs, and unmanaged OT devices should not get security agents unless the maker supports them in writing. Even then, test outside live production first. Use other controls instead.
Passive asset discovery, industrial firewalls, allowlists, and network detection can reduce exposure. These controls avoid changes to controller logic or process timing.
Protect the path, not the controller.
Access paths that deserve priority
Remote vendor access and privileged engineering sessions often reduce risk the most with the least production impact. Put vendor connections behind MFA, a hardened jump server, and privileged access management, or PAM. PAM gives time-limited access and records sessions.
PAM also prevents contractors from keeping plant passwords after work ends. This helps more than adding a login prompt to a PLC without a screen.
OT fails when traffic is blocked too early
OT Zero Trust fails when a plant enforces a rule before it knows every process link that rule might interrupt. Industrial control systems often use fixed addresses and old protocols. They can also use broadcast traffic and vendor links missing from diagrams.
Blocking one unknown flow can stop recipe downloads, alarms, production data, or maintenance work.
Deterministic flows need a baseline
PLC-to-HMI, controller-to-SCADA, and safety traffic should stay in observation mode until the plant validates protocols, links, and failure behavior. Fixed traffic must arrive in a known time pattern. A legacy PLC may also use undocumented vendor traffic shared by several machines.
Passive monitoring for one full production cycle is safer than a short capture. This often takes 14 to 30 days.
The error most teams make is treating quiet traffic as unnecessary traffic.
Shared accounts need a safe replacement
Shared engineering accounts should shrink over time, not disappear overnight. Teams keep them for fast troubleshooting across shifts. Old apps may support only one login.
Emergency access must also work during downtime. Create named accounts for normal work. Use PAM for just-in-time privileges.
Keep one tightly controlled break-glass account. Review its use after each event.
Human identity is only one part of access control in industrial control systems security. Plants must also identify machine identities. These include historian service accounts, SCADA connections, backup jobs, software licenses, certificates, API keys, and embedded protocol credentials.
List each identity by owner, purpose, source, destination, protocol, and expected schedule. Do this before rotating credentials or tightening policies. Some legacy PLCs and HMIs cannot support modern device checks.
In those cases, bind trust to the surrounding zone and approved path. Use the switch port and industrial firewall allowlist as controls.
A historian service account should only support its required data flow. It should not allow interactive login. Each exception needs an owner and regular review.
Choose controls by Purdue zone and flow
The right OT control depends on the zone and flow because OEM sessions, engineering workstations, and historian links create different risks. Network segmentation creates containment boundaries. Zero Trust checks who requests access, why, and under what conditions.
A controlled Industrial DMZ is usually more practical than a permanently air-gapped connected plant.
| Plant use case | First control | Where enforcement sits | Production risk | Rollback method |
|---|
| Remote OEM support | ZTNA, MFA, PAM | DMZ jump server | Low | Restore approved vendor route |
| Engineering workstation | Named identity, PAM | Workstation and jump server | Low to medium | Break-glass account |
| Historian to enterprise IT | Firewall conduit rules | Industrial DMZ | Medium | Reapply validated rule set |
| HMI to PLC | Passive discovery first | Network sensor | High | No inline enforcement initially |
| Legacy PLC | Allowlist and firewall policy | Cell or area boundary | High | Return to tested policy |
ZTNA, NAC, and PAM have different jobs
ZTNA controls user access to approved resources, PAM controls powerful accounts, and NAC decides if a device may join a network. ZTNA suits remote vendors because it avoids broad VPN access. PAM fits engineers who need elevated rights for a short time.
NAC can help with corporate laptops and known devices. It is not a safe first choice for old controllers. Those assets may not answer modern device checks.
A reference design can apply Zero Trust by Purdue zones without agents on controllers. Enterprise users in Levels 4 and 5 should reach production through a Level 3.5 Industrial DMZ. ZTNA, MFA, PAM, a hardened jump server, and session recording control remote vendor access there.
Engineering workstations in Level 3 should use named accounts. They should reach only their assigned cell or area in Levels 2 and 1. Approved conduits should control those links.
Passive sensors watch fixed OT traffic between HMIs, SCADA servers, PLCs, and safety systems. Industrial firewalls enforce tested allowlists at cell boundaries.
Historians should copy selected data through the DMZ. Broad enterprise queries should not enter control zones. This design protects PLCs and HMIs while keeping IT and OT access observable and reversible.
A 90-day pilot protects uptime first
A 90-day pilot can show OT Zero Trust value without changing live PLC logic. Start with one vendor or engineering access path. Choose a line with a known owner and planned maintenance window.
Also choose a line with a manual fallback procedure. Do not start with the most complex process.
Days 1 through 30: observe and map
Start with passive asset inventory, current network diagrams, and a map of every path from IT into OT. Record asset type, available firmware, owner, zone, and protocol. Record whether each connection is continuous, scheduled, or emergency-only.
Aim for at least 90% inventory coverage in the chosen zone. Watch two to four normal production patterns when product schedules rotate.
Visibility comes before enforcement.
Days 31 through 60: secure the doorway
Move remote access through an Industrial DMZ jump server with MFA, PAM approval, and session recording. Give each OEM technician a named identity. Grant access only to an approved target during an approved time window.
Test vendor sessions while operations staff are present. Confirm that access expires as planned. Check that recordings remain available and unrelated networks stay unreachable.
One common case involves a vendor who keeps VPN access after a repair. A time-limited jump-server session removes that standing path without changing any PLC setting.
Days 61 through 90: enforce and prove rollback
Turn on time-bound policy enforcement only after testing failure, recovery, and break-glass access. A rollback runbook must name the person who can disable a rule. It must also explain how to restore service.
The runbook should state the expected recovery time. It should list the people who need a call. For a low-risk remote-access pilot, a tested recovery target of 15 to 30 minutes is reasonable.
Measure results that operations and security both recognize:
- Exposed remote services: Count internet-facing OT entry points before and after the pilot.
- Vendor approval time: Measure median approval time. A practical target is under 30 minutes for planned work.
- Inventory coverage: Track the share of assets and flows confirmed in the pilot zone.
- Blocked events without production impact: Confirm that denied sessions or expired windows caused no line stoppage.
- Shared privileged accounts: Count accounts replaced by named, time-limited access.
Do not begin enforcement on critical control traffic if the plant lacks a reliable inventory or current network diagrams. Do not proceed without passive monitoring, approved change windows, and a tested rollback plan. Start with visibility and secure remote access instead. Do not begin with PLC or HMI segmentation.
A practical Zero Trust program should follow known industrial security frameworks. It should not become a separate compliance project. NIST SP 800-82 frames OT risk around safety, uptime, and legacy limits.
CISA guidance supports secure remote access, asset visibility, and segmentation priorities. SANS ICS resources can help teams check OT security during assessments and incident drills. A plant can map passive discovery to inventory and risk identification.
It can map industrial firewall allowlists to protected conduits. It can map PAM records to access accountability. This creates audit evidence without forcing IT assumptions onto production systems.
Common questions
Is zero trust practical for legacy PLCs?
Zero Trust works for legacy PLCs when controls protect access routes instead of placing agents on the PLC. Use industrial firewalls, allowlists, passive monitoring, and a controlled jump server. Do not change live control traffic before testing.
Can zero trust replace network segmentation in a plant?
No, Zero Trust cannot replace network segmentation because segmentation creates boundaries for Zero Trust policies. A plant needs both controls. Use zones and conduits for containment, then identity checks for users crossing boundaries.
Should an HMI require MFA for every operator?
Usually no, because repeated MFA can slow urgent operator actions and may lack HMI support. Apply MFA to remote access, engineering workstations, and privileged jump-server sessions. Use local procedures to track operator actions.
What is the safest first OT zero trust project?
The safest first project is remote vendor access through a DMZ jump server with MFA, PAM, and session recording. It reduces exposure without changing PLC logic. Many plants can validate it within 60 to 90 days.
How do you secure shared engineering accounts?
Secure shared engineering accounts by replacing routine use with named accounts and time-limited PAM access. Keep one tested break-glass route for emergencies. Log every use and review it after the event.
What proves an OT zero trust pilot worked?
A pilot worked when it reduced exposed access without stopping production or delaying approved maintenance beyond agreed limits. Track inventory coverage, vendor approval time, and shared-account reduction. Also track blocked events that caused no operational impact.
What matters most:- Protect remote people and privileged sessions before trying to control PLC traffic.
- Use Purdue zones and real operational flows to choose controls, not generic product lists.
- Require passive discovery, monitor mode, maintenance approval, and tested rollback before enforcement.
- Judge success by less exposure and uninterrupted production, not alert volume alone.
Learn more
Here are some additional resources on this subject:
