To Patch or Not to Patch OT— A Risk Management Decision
summary
Industry control sites run decades-old PLCs (one customer still uses PLC-5 hardware ~35–40 years old) while Dragos reports a 50% jump in manufacturing ransomware, so patching is a risk decision not a checklist. The session shows using automated OT-aware inventory and OTIDS (Rockwell-acquired tooling example), correlating CVE/CVSS 3.1 → 4.0 vectors, applying SSVC decision tree and active-exploit feeds, validating patches in a test lab (one Microsoft patch once downed a plant for a day), and keeping OT-specific backups and rollback playbooks.
AI-written summary · about
chapters (11)
- 0:00Patch management in OT
- 5:16Automated tools for asset visibility
- 11:59Leaky pipes in industrial systems
- 15:34Prioritizing vulnerabilities
- 21:55Ancillary systems and asset longevity
- 24:50Stakeholder vulnerability categorization
- 28:10Patch team and mitigation options
- 30:59Testing before deployment
- 33:30Backup plans for patching
- 35:15Documentation and change management
- 37:21Key takeaways and next steps
related talks
57mDon’t Forget the Little Guy: Vulnerability Management in Operational Technology
48mYou Too Can Secure OT
52mPanel: Industrial Systems In The Crosshairs: What It Really Takes To Defend OT
28mSo You Think You Can Patch
30mSoftware Patching Needn't Be a Can of Worms
40mDitching Run-To-Failure as Part of a Winning ICS Strategy
51mPreparing for and Defending OT Systems from Ransomware
47mField Guide to Building an Operational Technology Cybersecurity Capability