“Attackers are smart. One of the first things they’ll do is attack the backups,” Dickson says.
By maintaining immutable, isolated backups, organizations can prevent attackers from wiping out their recovery data, making it possible to reinstall their operating systems and restore other critical systems in minutes.
“While this doesn’t stop the initial breach, it dramatically reduces downtime and limits the operational and financial damage,” Dickson says.
Build OT Visibility Into SOC Workflows
Building OT visibility into SOC workflows is critical for defending manufacturing environments.
SOCs excel at monitoring standardized IT systems such as PCs, Microsoft Office and corporate networks, but struggle when faced with the thousands of highly specialized devices in industrial settings.
“Manufacturing is full of unique and bespoke tools,” Dickson says. “The SOC may be able to interpret connectivity or concerns, but the challenge is what they can do about it.”
In OT environments, availability often outranks confidentiality or integrity on the priority scale. Shutting down equipment can cause catastrophic damage, making immediate, informed responses essential.
RELATED: What would ransomware cost your business?
While SOCs can integrate OT signals and flag anomalies, the investigation and remediation must be handled by teams with intimate knowledge of each device’s function and operational context.
“Integrating a signal into the SOC so they can be aware is a good idea,” Dickson explains. “But the OT environment is going to have to do the investigations, detections and any sort of remediation.”
Apply Machine Identity Management for Device Trust
Machine identity management can improve device trust in industrial environments, largely by enforcing the principle of least privilege.
This approach ensures that only individuals with a legitimate need (plant managers or equipment operators, for example) can access specific devices.
“By tightly controlling access, organizations can drastically reduce the potential for malicious activity or accidental changes,” Dickson explains.
FIND OUT: The most overlooked step of identity access management.
The authentication process also confirms a user’s identity and authorization to define exactly what actions that user can perform.
For example, an operator might have permission to change a device’s operating speed, while a technician could be limited to viewing operational data.
“The more refined you get, the more secure you get,” Dickson says. This fine-grained permissioning makes it harder for bad actors to escalate privileges and gain control over critical equipment.
Machine identity management applies the same security philosophy as network microsegmentation, but instead of isolating systems through network architecture, it uses identity-based controls to create secure boundaries around device access.
“The fewer people that have permissions to access that equipment, the harder it is for bad actors to escalate privilege to get access to that device,” Dickson says.
KEEP READING: What's top of mind for manufacturing CISOs in 2025?
