Five cybersecurity myths that still circulate on industrial sites

Five beliefs come up on almost every site we assess. None of them is stupid, and each was true once. All five are now wrong in a way that costs money.

Myth 1: “An isolated network = safe”

Not necessarily. A USB stick, a contractor’s laptop or a temporary 4G router is enough to get round an air gap.

Myth 2: “Attackers don’t know our proprietary protocols or PLCs”

That stopped being true a long time ago. Information on industrial protocols, ICS architectures and PLC models is widely available online, and AI tools make it quicker still to find and digest.

Myth 3: “Our safety systems are fail-proof”

No system is immune to cyberattack. Safety systems are essential, but they should not be counted on as protection against cyber threats.

Myth 4: “Cybersecurity is an IT problem”

Far from it. Industrial cybersecurity concerns the whole site: OT teams, operations, maintenance, automation and site management, working with IT.

Myth 5: “Cybersecurity standards are too complex and restrictive”

There is some truth in that. But you have to start somewhere, learn, and improve step by step; once the logic clicks, things get much clearer. And with threats and regulations moving as they are, we do not really have a choice.

Why these five keep coming back

None of these beliefs is stupid. Each was true, or true enough, at some point. The air gap was real when the only cable leaving the cell went to a printer. Proprietary protocols really were obscure before their specifications were published and discussed online. Safety systems were isolated before they began sharing a network with everything else.

The beliefs survive because nothing on site contradicts them loudly. A plant can run for fifteen years on a flat network without an incident, and that reads as proof the network is fine, when all it shows is that nobody has tried yet. On a shop floor, “it has never happened” is a very persuasive argument. In a risk assessment it is one of the weakest.

The question that replaces the myth

Arguing with each belief rarely gets anywhere. We find it more useful to swap it for a question that can actually be answered on site.

Instead of asking whether the network is isolated, list every way data physically enters this cell in a normal week: USB, laptop, remote session, 4G box, a contractor’s phone. The list is always longer than people expect.

Instead of wondering whether anyone knows your protocols, spend fifteen minutes searching for your own controller model online. Whatever you find, an attacker finds faster.

Instead of asking whether the safety systems are immune, draw everything that can reach the safety PLC. If the drawing shows more than one path, you have your answer.

Instead of debating whether this is an IT problem, name the person who decides a controller firmware update. If that person sits in IT, the plant has a different problem.

And instead of finding the standards too complex, pick one zone and define it properly. IEC 62443 stops being abstract the moment it is applied to one real cell.

That last one matters most. The standard is large, but nobody is meant to swallow it whole. A first zone, a first conduit and a first risk assessment on a single production line teach more than a year of reading, and they leave something an auditor can look at.

Industrial cybersecurity has to be practical, structured and continuous, and fitted to the reality of the field. One zone, properly defined, teaches more than a year of reading.

Reference

• ISA/IEC 62443-3-2, risk assessment and zone and conduit design; a first zone on one production line is the usual starting point.