Shining a light into the security blackhole of IoT and OT

The speaker, Huxley Barbee, draws on consulting work with manufacturing, transportation and higher education clients to explain how operational technology differs from IT. OT environments prioritise availability above all else, many devices run old software that is rarely patched, and many do not require authentication. He traces the erosion of air-gapped networks to around 2005, when organisations began connecting OT systems to the internet for remote management.

He walks through the Purdue model as an ideal that few organisations actually follow, and notes that default credentials and public vulnerability listings can give an attacker a practical path to exposed controllers. Passive network monitoring, the usual defensive approach, struggles with peer-to-peer site traffic and produces inventories with gaps and weak fingerprinting. Active scanning, however, can crash or freeze fragile devices through non-standard packets, security probes and heavy traffic.

To address this, he proposes five principles for active scanning in OT: avoid unusual packets, be careful with vulnerability probes, tune both packet volume and how traffic is distributed, fingerprint incrementally with benign queries first, and start small before expanding. The planned section on IoT devices was skipped for time. A practitioner should take away the need to inventory OT assets carefully and test scanning against fragile systems before running it broadly.