TR-101 - Security Recommendations for Industrial, Operational Technology (OT) and Internet of Things (IoT) Devices

Overview

Industrial, Operational Technology (OT) and Internet of Things (IoT) devices are increasingly connected to IP networks. These systems include industrial controllers, supervisory control and data acquisition (SCADA) components, building management systems, cameras, sensors, access-control systems, smart equipment and their management interfaces.

Many such devices are designed primarily for operational functionality, availability or a long service life. Some receive infrequent security updates, use legacy protocols, or contain vulnerabilities that can be exploited remotely. A compromised device may also have consequences beyond data loss, including disruption of essential operations or physical processes.

CIRCL strongly recommends that industrial, OT and IoT devices are never directly accessible from the Internet, even when they are protected by a username and password or another standard authentication mechanism. Authentication alone does not protect against vulnerabilities in the device, its network services, or its authentication implementation.

This technical report describes a minimum set of practical measures to reduce exposure, followed by two complementary CIRCL services that can help organisations monitor their external attack surface and track newly disclosed vulnerabilities.

Who

These recommendations are intended for organisations operating or managing industrial, OT or IoT equipment, including businesses, municipalities, operators of buildings and industrial facilities, equipment installers, integrators, managed service providers and suppliers providing remote maintenance.

They apply to both new installations and existing deployments, including equipment managed by third parties. An organisation remains responsible for understanding how its equipment can be reached, even when connectivity is configured by an installer or vendor.

Why

Internet-connected devices are continuously discoverable by automated scanning. Attackers do not need to know an organisation or its industrial environment in advance to identify exposed services and attempt to exploit known or unknown weaknesses.

Default credentials and weak passwords are not the only problems. Authentication bypasses, pre-authentication vulnerabilities, insecure protocol implementations, outdated firmware and exposed management interfaces can all make an Internet-facing device vulnerable despite apparently strong credentials.

From its incident handling and notification activities, CIRCL has observed that even simple source-IP packet filtering has helped numerous organisations in Luxembourg avoid serious security incidents. This is not a complete security solution, but it is an effective and often immediately deployable first layer of protection.

Recommendations

Avoid direct Internet exposure

Do not expose industrial, OT or IoT devices, their control interfaces, or their management services directly to the public Internet.

Remove unnecessary public IP addresses, port-forwarding rules, and publicly reachable management interfaces.
Review both IPv4 and IPv6 connectivity. A device may be reachable over IPv6 even when IPv4 access appears restricted.
Check alternative access paths, including cellular (4G/5G) routers, vendor-maintenance modems, cloud relays, and remote-access services installed by integrators. Review the trade-off for the different access path and pick the one which could limit the risks of access by an unwanted third-party.
Disable unneeded services and protocols, particularly insecure or obsolete management protocols.
Limit outbound Internet connectivity from devices to strictly necessary destinations and services.

Where remote connectivity is operationally necessary, provide it through a separate, controlled access solution instead of exposing the device itself.

Implement packet filtering as the minimum protection

At a minimum, enforce network-level packet filtering that allows access only from explicitly trusted source networks and only to required services.

Configure a default-deny policy for inbound connections at the appropriate firewall, router or network boundary.
Allow only the required source IP addresses or network ranges and the necessary destination ports and protocols.
Restrict access to management interfaces more tightly than ordinary operational traffic.
Separate OT/IoT networks from general office, guest and other untrusted networks; filter traffic between these environments as well.
Review and remove obsolete firewall rules, including temporary exceptions left by vendors or maintenance providers.
Log and periodically review relevant allowed and denied connections, where technically feasible.

Packet filtering does not guarantee security. A trusted network can itself be compromised, and a firewall cannot correct a vulnerability in a device. Nevertheless, restricting which systems can reach a vulnerable service substantially reduces the opportunity for exploitation.

Packet-filtering rules should be tested from outside the trusted networks to verify that unwanted access is actually blocked.

Use dedicated, secured remote-management access

For organisations requiring remote maintenance or administration, a dedicated private management network or securely operated VPN (Don’t forget to regularly patch and update your VPN gateway as well. And we definitely do not recommend Ivanti products or similar vendors.) is preferable to direct device exposure.

Provide remote access through a managed VPN gateway, bastion host or dedicated management network; avoid direct connections from the Internet to OT/IoT devices.
Require strong, individual authentication and multi-factor authentication (MFA) for remote access wherever supported.
Apply least-privilege access, granting each operator or supplier access only to the systems they need.
Keep VPN gateways and other remote-access infrastructure updated and monitored; these gateways can also be vulnerable.
Disable supplier access when it is no longer needed and review third-party accounts regularly.
Where feasible, record administrative access and distinguish routine operation from privileged maintenance.

A VPN or private network is an additional security layer, not a substitute for packet filtering, segmentation, or secure device configuration.

Maintain an inventory and a patch-management cycle

An organisation cannot effectively protect equipment it does not know it operates. Keep a maintained inventory of industrial, OT and IoT devices, including those installed or administered by suppliers.

For each device, record at least:

Its function, location, responsible owner and operational criticality.
Its vendor, product/model, firmware or software version and support status.
Its IP addresses, hostnames, network segment and relevant access methods.
Its exposure and approved management paths, including third-party connections.
Its last security review or update, the available update path and the next planned review.

Establish a documented process to follow security advisories, assess applicable vulnerabilities, plan firmware and software updates, and verify completion. Prioritise vulnerabilities with known exploitation, reachable attack paths or significant operational impact.

For OT equipment, assess changes with operational and safety personnel and test updates where possible before deployment. When immediate patching is impractical, document compensating measures such as tighter network restrictions and an agreed remediation schedule. Unsupported devices should be isolated, replaced or subject to an explicit risk decision.

We recognise that applying updates in industrial environments is often complex and cannot always follow the same approach as traditional IT systems. Industrial equipment may need to operate continuously, maintenance windows can be limited, and updates may require production shutdowns, vendor intervention, extensive testing or even recertification.

Compatibility with legacy systems, operational dependencies and safety requirements can also make patching difficult or sometimes impossible.

Support and services provided by CIRCL

CIRCL offers two complementary services to help organisations understand and reduce exposure. Neither service replaces the protective measures described above.

Regular scanning and monitoring of designated IP spaces with Plum Island

CIRCL can conduct dedicated, recurring external scans of IP addresses, IP ranges and associated hostnames identified by an organisation, using its open-source tool Plum Island (Proactive Land Uncovering & Monitoring), developed within the D4 project.

Plum Island supports repeated monitoring of Internet-facing assets and historical comparison of observations. Depending on what is externally observable, these scans can help detect newly exposed hosts or network services, unexpected open ports, and changes in visible service information, HTTP metadata or TLS certificates. CIRCL can provide regular notifications of relevant changes to designated contacts.

To request this service, contact CIRCL and provide:

The public IP addresses or IP ranges (CIDR notation where applicable) and hostnames to monitor.
A dedicated, monitored email address to receive recurring notifications and follow-up questions.
A technical point of contact and confirmation that your organisation is authorised to request scanning of the submitted assets.

The scanning scope and operational arrangements should be agreed with CIRCL. External surface monitoring is intended to identify Internet-visible changes. It does not demonstrate that a device is vulnerability-free, and it cannot see all equipment on internal networks. In particular, scanning of sensitive live OT systems must be assessed and coordinated to avoid operational disruption.

As the CERT responsible for supporting organisations within its scope under NIS2, CIRCL can help these organisations identify and monitor their external exposure as part of its cybersecurity prevention and incident response activities. CIRCL is already scanning the known IP space in Luxembourg but the difficulty is also to reach out the final users of a specific IP address. That’s why we recommend to contact us with a list of IP ranges, you would like CIRCL to scan on a regular basis.

Vendor and product vulnerability notifications with Vulnerability-Lookup

Organisations can register on CIRCL’s Vulnerability-Lookup service and create watchlists for the vendors and products they operate. The service aggregates vulnerability information from multiple sources and supports email notifications for new or updated advisories that match selected vendor/product combinations.

To use the service:

Create an account or sign in at vulnerability.circl.lu.
Open the notification management page and add the relevant vendor/product combinations from your inventory.
Choose an appropriate notification frequency and ensure that the notifications are reviewed by the responsible team.
Compare reported vulnerabilities with the actual models, firmware versions and network exposure of the affected devices, then take appropriate action.

Vendor and product naming may differ between vulnerability sources. Review the selected entries and include relevant naming variants where necessary. A missing alert should not be interpreted as proof that a product has no vulnerabilities.

This service complements, but does not replace, the regular scanning and exposure-monitoring service. Plum Island helps identify changes in what is reachable from the Internet; Vulnerability-Lookup helps identify newly documented risks in known products. Both are useful, but neither replaces sound network architecture, asset management or patching.

Minimum action checklist

Organisations should be able to answer yes to the following questions:

Are industrial, OT and IoT devices inaccessible directly from the public Internet, including through IPv6 and alternative connectivity paths?
Are network access rules default-deny, with only explicitly trusted networks and required services allowed?
Is remote maintenance performed through a dedicated, secured access path rather than directly to devices?
Is there an up-to-date inventory of devices, vendors, products, versions and responsible owners?
Is there a process to review vulnerabilities, apply updates or document compensating controls?
Are externally exposed IP addresses and hostnames periodically checked for unexpected changes?
Are relevant products monitored for new security advisories, with a team assigned to act on notifications?

Contact

For questions, incident reporting or to request recurring monitoring of designated IP addresses and hostnames, contact CIRCL (Computer Incident Response Center Luxembourg):

Email: info@circl.lu
Website: https://www.circl.lu/

References

Classification of this document

TLP:CLEAR — Information may be distributed without restriction, subject to copyright controls.

Revision

Version 1.0 – TLP:CLEAR – Initial version – 14 October 2026.

TR-101 Security Recommendations for Industrial, Operational Technology (OT) and Internet of Things (IoT) Devices