Industrial IoT security means protecting connected sensors, controllers, gateways and their cloud links in factories, utilities and similar sites, where a failure can stop production or hurt people. Start by finding every device, separate the control network from office and cloud networks, limit remote access, and monitor passively.
What makes IIoT different from office IT?
NIST's guide to operational technology, SP 800-82 Rev. 3, says OT security must address unique performance, reliability and safety requirements. That sentence explains most of the differences.
- Availability and safety come first. A rebooted controller can halt a line or open a valve. Patching on a Tuesday afternoon is rarely an option.
- Long lives. Equipment may run for twenty years on firmware nobody updates.
- Weak protocols. Many industrial protocols were designed for closed networks and have no authentication or encryption. Anything on the network that can speak the protocol can issue commands.
- Timing constraints. Some systems cannot tolerate the delay of deep inspection.
- Convergence. IIoT adds Wi-Fi, cellular, cloud dashboards and vendor remote access to systems that used to be isolated.
What are the common attack paths?
- Remote access. A vendor VPN with a shared password straight into the control network.
- Flat networks. A phishing compromise in the office reaches controllers because nothing separates them.
- Exposed devices. A gateway or HMI reachable from the internet with default credentials.
- Cloud connectors. An over privileged API key that lets a compromised dashboard send commands back to devices.
- Supply chain. Vulnerable libraries in device firmware and gateway software that the plant cannot easily update.
CISA maintains guidance for control system owners, including recommended practices on defense in depth for industrial control systems.
What is a sensible order of work?
Constructed example: a food plant has 40 sensors on a wireless gateway that uploads to a cloud dashboard. A review finds the gateway uses a default password, shares a flat network with the office, and its uploader key could also write setpoints. The team's first week fixes the password and removes write permission from the key. The next month moves the gateway into its own segment with one outbound rule. Cheap steps came first and removed the worst paths.
How to check or apply this
- Inventory. List every device, firmware version, protocol, owner and connection. Passive network monitoring can discover devices without sending traffic that might disturb them.
- Segment. Put control devices in zones with controlled conduits, so office and cloud traffic must pass through a firewall that allows named flows only.
- Control remote access. Use individual accounts, multi factor authentication, session recording and time limited approval for vendors. No always on tunnels with shared credentials.
- Change defaults. Replace factory passwords, disable unused services and ports.
- Monitor passively. Watch for new devices, unexpected commands and connections to unusual destinations. Alert the people who can act, including operations staff.
- Patch with a plan. Use maintenance windows, test on a spare unit, and where you cannot patch, add compensating controls like segmentation and allow lists.
- Secure the cloud edge. Give each data feed a credential that can only do its one job, and rotate it.
- Rehearse. Practice what happens if you must run a line manually and isolate IT from OT.
- Ask suppliers for a software bill of materials for gateway and device software, so you can tell when a new library vulnerability matters to you.
Safeguard covers software supply chain and application security, such as dependency scanning and SBOMs for software you build or run. It is not an industrial network monitoring product.
Quick check
Is IIoT the same as OT?
Not quite. OT is the broader set of systems that monitor and control physical processes. IIoT usually refers to the connected, often cloud linked layer of sensors and gateways within it.
Should I scan an industrial network with a normal vulnerability scanner?
Be careful. Active scans can crash fragile devices. Prefer passive discovery, and test active scanning on a lab copy or in an agreed window.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security
- CISA, ICS Recommended Practices
- NIST SP 800-207, Zero Trust Architecture
Last reviewed: 18 October 2026.
