When an OT device has a password you cannot change, put it in a small isolated enclave, allow only named hosts to reach it, log every login attempt, and plan its replacement. CISA's Volt Typhoon advisory recommends compensating controls such as enclave segmentation and enhanced logging in this case.
The problem
Attackers try default vendor credentials. The Volt Typhoon advisory says actors tested access to domain joined OT assets with default vendor credentials. The Unitronics advisory describes access through default or missing passwords on internet connected controllers. Where a password can be changed, change it. Where it cannot, you need other controls.
What the advisory suggests
For devices where the password cannot be changed, CISA recommends compensating controls such as enclave segmentation and enhanced logging. For OT assets where technically feasible, it suggests passwords of at least 15 characters, and logging all login attempts where that is not possible.
Build the compensating set
- Enclave. Place the device in a small zone containing only what it needs to talk to.
- Allowlist. Permit connections from named engineering or supervisory hosts and block the rest, using the default deny approach the advisory describes for OT networks.
- Intermediary. Require remote access to go through a monitored firewall, bastion host or jump box with MFA on the jump host.
- Logging. Log connections and login attempts, and alert on any from unexpected sources.
- No internet. Confirm there is no inbound path from the internet. Check regularly.
- Physical. Secure cabinets and ports, since a password you cannot change is also one that many people may know.
Ask the vendor
Ask whether a newer firmware, a configuration option or a different model removes the limitation. CISA's Unitronics advisory urges manufacturers to ship products without default passwords, so make the request part of your procurement criteria going forward.
Record the exception
Treat each unchangeable credential as a documented exception: device, risk, compensating controls, owner, and review date. Revisit when equipment is scheduled for replacement. A register makes the work visible to management and auditors.
Plan the exit
Add these devices to the replacement plan with a date. Compensating controls reduce risk, but they depend on being kept up, and each one is another thing that can fail.
Where passwords can be changed
Do it in a window with operations, update the stored credential in your password manager or vault, and update any systems that connect with the old one. Record the change in your inventory.
Test the enclave
After you build it, try to reach the device from an unapproved host and confirm the attempt fails and is logged. Repeat the test after any network change. An untested control is an assumption.
Quick check
Is a long password always possible on OT?
Not always. CISA suggests at least 15 characters where technically feasible, and logging login attempts where it is not.
What is an enclave?
A small isolated network segment containing the device and only the hosts it needs, with strict rules at its boundary.
Sources
Last reviewed: 19 October 2026.
