Cybersecurity
OT and ICS Cybersecurity: A Practical Guide to IEC 62443
Industrial environments cannot be secured like an office network. A practical approach to visibility, segmentation and monitoring that respects safety and uptime.
Key takeaways
- Attackers usually enter through stolen credentials, exposed remote access or unpatched edge devices.
- Immutable, isolated and tested backups are the difference between a bad week and a business crisis.
- Decide in advance who makes which decisions — including legal, regulatory and communications steps.
- Rehearse recovery, not just backup: measure how long a full restore really takes.
How a typical attack unfolds
Modern ransomware is rarely a single piece of malware. It is a campaign: initial access through phishing, stolen credentials, an exposed remote desktop or an unpatched VPN appliance; privilege escalation to domain administrator; discovery and data theft; deletion or encryption of backups; and finally encryption of production systems, often timed for a weekend or holiday. Each stage is an opportunity to detect and stop the attacker.
Prevention: the controls that matter most
- Phishing-resistant MFA on email, remote access and all administrative accounts.
- Patch internet-facing systems first — VPNs, firewalls, mail gateways and file-transfer tools are favourite entry points.
- Remove exposed RDP and other remote administration services from the internet.
- Tiered administration and PAM so that a compromised workstation cannot yield domain admin credentials.
- EDR on every endpoint and server, monitored 24x7 with authority to isolate.
- Application allow-listing on servers and macro restrictions for office documents.
Backups that survive an attack
Attackers target backups deliberately. Follow the 3-2-1-1-0 principle: three copies, on two media types, one off-site, one immutable or offline, and zero errors on restore tests. Keep backup administration on separate credentials, ideally in a separate identity domain, and protect the backup console with MFA.
Response: decisions to make before the incident
| Decision | Owner | Prepared in advance |
|---|---|---|
| Isolate networks or systems | CISO / IT operations | Containment runbook and authority |
| Engage incident response specialists | CISO | Retainer agreement in place |
| Notify regulators and authorities | Legal / compliance | Regulator, data-protection and law enforcement contacts |
| Customer and staff communications | Communications | Pre-approved holding statements |
| Restore priority | Business owners | Ranked list of critical services from the BIA |
Recovery: speed comes from rehearsal
Most organizations discover during a real incident that restoring everything takes far longer than expected. Run a full recovery exercise at least annually: rebuild identity services, restore a critical application from immutable backup, and time each step. Use the results to set realistic recovery time objectives and to justify investment where the gaps are.
Regulatory context
Breach-notification duties under GDPR, sector regulators and rules such as the EU's DORA for financial entities impose tight reporting windows. Build those timelines into your playbook so that legal obligations are met while the technical response is under way.
Next step: book a ransomware readiness assessment with our Cybersecurity Services and Business Resilience specialists.
Frequently asked questions
Should we pay a ransom?
That is a board-level decision that involves legal, regulatory and sanctions considerations. Payment does not guarantee recovery or deletion of stolen data. Preparation reduces the chance you ever face the choice.
How often should we test backups?
Test restores of critical systems at least quarterly and perform a full recovery exercise at least once a year.
Is cyber insurance enough?
Insurance transfers part of the financial impact, but insurers increasingly require MFA, EDR and tested backups as conditions of cover. It complements controls; it does not replace them.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
