The most frequent (and most dangerous) OT security mistakes in Poland
| # | Mistake | Real-world consequence seen in audits |
|---|---|---|
| 1 | No network segmentation between IT and OT | Ransomware from office network encrypts PLCs in <4 h |
| 2 | Default or no passwords on PLCs, HMI, SCADA | Attacker gains full control in minutes |
| 3 | Outdated, unpatched systems (Windows XP, Siemens S7-300 without updates) | Exploits from 2010 still work |
| 4 | Direct internet exposure of OT devices | Systems visible in Shodan → instant compromise |
| 5 | No logging or monitoring in OT | Attack goes undetected for months |
| 6 | Shared accounts & no MFA for critical systems | One compromised engineer credential = full plant access |
| 7 | USB devices without control | 90 % of OT infections in Poland start from an infected pendrive |
Correct approach (mandatory for NIS2 and ISO/IEC 62443)
- Full IT–OT segmentation segmentation (zones & conduits, Purdue model)
- Hardware firewalls and OT-specific monitoring (Nozomi, Claroty, Dragos)
- Strict least-privilege access + MFA/PAM
- Regular patching & hardening of PLC, HMI, SCADA
- USB control + endpoint protection and whitelisting
- Continuous OT asset inventory and anomaly detection
Fixing these seven mistakes eliminates ~95 % of real-world OT attacks I investigate.