UK NCSC Urges OT Operators to Reduce Internet Exposure After Disruptive Cyber Activity

Alert focuses on exposed OT and edge infrastructure

The UK National Cyber Security Centre (NCSC) issued an alert on August 27 warning that it has seen increased targeting of operational technology systems across multiple sectors worldwide, including in the United Kingdom. The agency said activity by a range of threat actors has caused limited real-world disruption, but did not attribute the activity to a particular group or describe specific affected organizations.

The warning applies to organizations that operate, deploy or maintain OT. That includes industrial operators and the engineering, integration and service teams that connect control environments to enterprise networks, vendor support channels or remote maintenance workflows. The core issue is not simply whether a site intends to expose OT: the NCSC cautions that misconfiguration, legacy connections and unmanaged assets can make systems reachable without the owner realizing it.

Build an exposure inventory before selecting controls

The first practical task is to create a definitive view of the OT environment: assets, communications paths, external connections and third-party dependencies. For procurement and installation teams, that record should extend beyond controllers and operator stations to the boundary equipment that enables connectivity, including industrial gateways, firewalls, routers, cellular equipment and remote-access appliances.

This inventory should distinguish systems that genuinely require external connectivity from those that do not. U.S. CISA guidance similarly recommends identifying internet-accessible assets, determining whether exposure is operationally necessary and removing or restricting access where it is not. An asset list that includes owner, location, firmware or software version, support status, management method and business purpose makes it easier to prioritize remediation without creating unnecessary process outages.

Treat OT edge devices as a lifecycle responsibility

The NCSC specifically calls for devices that provide external connectivity to remain within vendor support, receive routine updates and be replaced before end of life. This shifts attention to components that may sit between IT and control networks for many years, even when the underlying PLC, HMI or supervisory system has been subject to closer engineering oversight.

A supported device is not automatically securely configured, and a security update should be assessed against operational constraints before deployment. Still, unsupported equipment creates a difficult risk position because security defects may no longer receive fixes. Organizations should maintain a support and replacement plan for each internet-facing or boundary device, including any remote-access appliance that could provide a route into OT. Where direct exposure cannot be removed immediately, access should be restricted, monitored and subject to strong authentication.

Separate management access from the public internet

The alert recommends that management of industrial gateways, firewalls, routers and remote-access appliances be possible only from a segregated management network that is not connected to the internet. The wider OT, management and business networks should also be separated by function and criticality, with only necessary communications permitted between zones.

This is a design and commissioning issue as much as a policy issue. Integrators should document permitted data flows, administrative paths and remote-support methods before handover. Administrators should use individual accounts rather than shared credentials, remove default passwords, and use multifactor authentication where supported. The NCSC also identifies public/private-key authentication for SSH as a stronger alternative to password-only access where the protocol and equipment support it.

Retire insecure protocols and monitor predictable OT traffic

The NCSC advises organizations to adopt secure industrial and management protocols where possible. Its examples include moving from Telnet and SNMPv1 or SNMPv2 to more secure options, and using protected variants of industrial protocols when available. When no secure alternative exists, the guidance says use of insecure protocols should be limited to isolated network segments.

Logging and monitoring should cover connectivity to and within OT networks, particularly attempts to reach PLCs and HMIs from unfamiliar devices, networks or routes. Because industrial communications are often comparatively static, a baseline of normal traffic can help teams identify unexpected connections, configuration changes and potential lateral movement. This monitoring should also include the edge devices that enforce segmentation, not only the control assets they protect.

Plan for safe recovery as well as prevention

The NCSC recommends operating OT devices in a state that prevents remote programming during normal operations, such as avoiding maintenance modes when they are not required and using controller write protection or equivalent safeguards. These measures can reduce the chance that an unauthorized endpoint changes control logic or operational processes.

Finally, organizations should maintain and test backups of configurations, controller logic and critical engineering data, then practice isolation and restoration procedures. For facilities, the test is whether a team can safely regain essential operations from trusted information after a cyber incident—not merely whether backups exist. The NCSC also points organizations to its Early Warning service and broader resilience guidance as ways to identify exposed vulnerabilities and strengthen preparedness over time.