Operational continuity as a security objective

Where plant estates are structurally exposed

Not through negligence. Through the accumulated consequences of equipment lifecycles measured in decades.

Line controllers and human-machine interfaces running operating systems that cannot be patched without vendor certification. Flat networks where a compromised office endpoint can reach plant systems. Shared operator accounts, because individual logins slow a shift change. Remote access for equipment vendors granted years ago and never reviewed. Backup systems never tested against a full-plant restore.

Each of these was a reasonable local decision. Collectively they describe an estate where the most likely intrusion path runs from a phishing email to a production stoppage.

• Controllers and HMIs on operating systems that cannot be patched without vendor approval
• Flat networks permitting lateral movement from corporate to plant systems
• Shared operator accounts at the line, driven by shift-change practicality
• Standing vendor remote access, granted for a commissioning that finished years ago
• Backup systems that have never been restored at full plant scale

What the reframing changes

If the objective is confidentiality, the priority is data classification and exfiltration prevention. If the objective is availability, the priority order changes.

Segmentation comes first, because it limits how far an intrusion in the corporate estate can travel and it does not require touching equipment under vendor certification. Identity comes second, because multi-factor authentication and conditional access close the most common entry path. Detection tuning comes third, because an untuned console is functionally the same as no detection and this is a tuning problem rather than a licensing one.

Recovery moves from a technical afterthought to a first-order design constraint, and it is where the reframing has the largest practical effect. A recovery objective agreed with operations and expressed in shifts produces different investment decisions from one expressed in days by IT.

The automation boundary

Automated response — isolating a device, disabling an account — is appropriate on standard user endpoints and rarely appropriate on plant-adjacent systems during a shift.

An automated isolation of the wrong host stops a line, and the incident will be remembered as an IT failure regardless of what the intrusion was doing. Agreeing the boundary in advance, in writing, with operations present, is the difference between a control that reduces risk and one that creates it.

This is a governance decision that looks like a configuration setting, which is why it is so often made by default.