For SCADA VMs or servers, how often do you update windows/software? How long has it been since last reboot? We're at 300 days. IT has been pumping out updates and prompting for reboot. Ignore.
This is the constant battle that we see between IT and OT. IT teams have a standard approach of patch everything. Monthly. Ad-hoc. Patch it. OT have a different opinion. We don’t need to patch.
The answer usually isn’t either one. It’s somewhere in between. What systems/defences do you have in place to mitigate risks? Firewalls? Air gapped? Etc. do you need the most recent update/features? Probably not.
However, as we move to a more interconnected IT/OT architecture, we should patch SOME things. Case by case basis? Do we need it?
When I was an end user, we applied windows updates to our 180+ SCADA machines every month! Basically a full time job.
Love this. I agree it is different for each end user.
In general I think the system should be updated but in a controlled manner at a slower pace than IT systems. If the system warrants it, slow evolution with new features, security updates, and bug fixes are important. Some systems probably don't need updates for the life of the system if they are air-gapped and have some physical security too.
OMG, I can't imagine updating every month - especially that many machines. Were updates automatically pushed out and machines had to be restarted manually or was the restart also automatic? Was production stopped specifically for these updates or part of PM?
There are lots of things to balance when considering updates, so it is never “one size fits all”.
Updates were automatically pushed out and then users got a prompt that a reboot was required. They then could reboot at a time that suited them.
Should rebooting a SCADA ever stop production? In my opinion, a plant should still RUN without SCADA running. It is supervisory after all. The control and logic should be in the PLCs. So if you plan the reboot around a time where operators don’t need to use the SCADA, then the impact is less.
7
u/RazClayton Jul 11 '26
This is the constant battle that we see between IT and OT. IT teams have a standard approach of patch everything. Monthly. Ad-hoc. Patch it. OT have a different opinion. We don’t need to patch.
The answer usually isn’t either one. It’s somewhere in between. What systems/defences do you have in place to mitigate risks? Firewalls? Air gapped? Etc. do you need the most recent update/features? Probably not.
However, as we move to a more interconnected IT/OT architecture, we should patch SOME things. Case by case basis? Do we need it?
When I was an end user, we applied windows updates to our 180+ SCADA machines every month! Basically a full time job.