For years, the operational technology (OT) community has relied on a comfortable assumption: if it is not connected to the internet, it is safe. This ‘security through obscurity’ model worked reasonably well when air-gaps were real and network topologies were static. Today, that era is over. As industrial networks converge with IT infrastructure, protocols like Modbus and DNP3 have been forced into the spotlight, revealing their inherent lack of authentication and encryption.
Enter OPC UA (Open Platform Communications Unified Architecture). Often marketed as the ‘silver bullet’ for industrial connectivity, OPC UA was designed to solve the interoperability crisis between disparate vendors like Rockwell, Siemens, and Schneider Electric. But while it succeeds brilliantly at data exchange, it introduces a complex layer of security that is frequently misunderstood, misconfigured, or entirely ignored by plant managers and OT engineers who are under pressure to enable remote access and digital transformation.
The reality is that OPC UA is not a single protocol but a framework. Its security model is robust only if implemented correctly. When it is not, you are left with a high-bandwidth, highly visible attack surface that looks secure but offers little protection against sophisticated adversaries. This post explores the specific gaps in OPC UA security, why passive visibility matters more than active scanning, and how operators can bridge the fidelity gap between their asset inventories and actual network states.
The Illusion of Security in Default Configurations
OPC UA’s greatest strength—its flexibility—is also its most significant vulnerability. Unlike legacy protocols that are ‘open by default,’ OPC UA is ‘secure by design’ but often ‘insecure by deployment.’ The protocol supports multiple security policies, including None, Sign, and SignAndEncrypt. In theory, this allows for granular control over data confidentiality and integrity.
In practice, however, many industrial devices ship with default configurations that prioritize ease of use over security. A common scenario involves an OPC UA server configured to accept connections without any encryption (SecurityPolicy = None). To an IT security tool, this might look like a standard HTTP port. To an OT engineer, it is a clear-text data stream containing sensitive process variables, alarm states, and setpoints.
Even when encryption is enabled, the complexity of the certificate management lifecycle becomes a bottleneck. OPC UA relies on X.509 certificates for mutual authentication. In large-scale deployments with hundreds of endpoints, managing these certificates manually is error-prone. Expired certificates lead to connection failures, prompting operators to disable security checks to restore production. This creates a recurring cycle of insecurity that undermines the entire safety case.
Furthermore, the protocol’s complexity means that not all implementations are created equal. A Siemens S7-1500 and a Schneider Modicon PLC may both speak OPC UA, but their implementation of security policies may differ significantly in how they handle revocation lists or certificate validation. This heterogeneity makes it nearly impossible for IT teams to apply uniform security controls without deep OT-specific knowledge.
Why Active Scanning Fails in OT Environments
When organizations attempt to assess their OPC UA landscape, the instinct is often to deploy active vulnerability scanners. This approach is fundamentally flawed in an industrial context. Unlike IT servers that can reboot without consequence, a PLC or RTU running on a critical loop may not tolerate unexpected network traffic patterns.
Active scanning of OPC UA endpoints can cause:
- Denial of Service (DoS): Aggressive port scanning or certificate negotiation attempts can overwhelm low-power devices, causing them to drop connections or enter a fault state.
- Process Disruption: Some OPC UA servers interpret unusual query patterns as malicious attacks and may trigger automatic safety shutdowns or alarm states.
- Misidentification: Scanners often fail to distinguish between an OPC UA server and other industrial services, leading to false positives that waste engineering time.
This is where the Red Trident position on passive discovery becomes critical. We consistently find that active assessments introduce more risk than they mitigate. Instead, operators should rely on passive network monitoring to map OPC UA communications without ever sending a packet to the endpoint. This approach aligns with NIST SP 800-82 guidelines for securing ICS, which emphasize non-intrusive monitoring as the primary method for asset discovery and behavior analysis.
By observing the ‘handshake’ process passively, you can determine the security policies in use, identify the certificates presented, and validate authentication mechanisms without touching the device. This is not just a best practice; it is a necessity for maintaining operational continuity while gaining visibility into your OT network.
The Data Fidelity Gap: Inventing Assets You Don’t Have
One of the most pervasive challenges in OT security is the ‘data fidelity gap.’ This term describes the discrepancy between what your asset inventory says exists and what is actually communicating on the wire. Recent research from Nozomi Networks Labs highlights how real-time ICS network visualization can proactively identify hidden vulnerabilities, but it also points to a deeper issue: inconsistent data fidelity between asset management systems and network telemetry.
In the context of OPC UA, this gap manifests in several ways:
- Undocumented Servers: Engineering teams often deploy temporary OPC UA servers for testing or commissioning. These ‘shadow’ assets are rarely added to the official inventory but continue to operate indefinitely.
- Dynamic Endpoints: OPC UA allows for dynamic endpoint registration. A device may change its IP address or port configuration during normal operation, breaking static firewall rules and creating blind spots in monitoring tools.
- Legacy Integration: Older devices may be connected to modern OPC UA servers via gateways that do not fully propagate security context, effectively bypassing encryption at the protocol level.
This lack of visibility creates a false sense of security. You might believe your OPC UA infrastructure is secure because you have configured certificates on the primary servers. But if there are five undocumented gateways operating in ‘None’ mode, your entire environment is compromised. As noted in recent vendor research from Claroty and Team82, current asset visibility tools often fail to account for these dynamic changes, leaving operators with outdated or inaccurate inventories.
To close this gap, operators must move beyond periodic audits. Continuous monitoring that correlates device behavior with asset data is essential. By understanding the normal communication patterns of each OPC UA endpoint, you can detect anomalies such as unexpected certificate requests or connections to unknown endpoints.
Turning Findings into Actionable Roadmaps
Identifying these gaps is only half the battle. The other half is prioritizing remediation efforts in an environment where everything seems critical. In our assessments, we often find that operators struggle to distinguish between high-risk vulnerabilities and low-risk configuration drifts.
We recommend a three-step approach to making OPC UA findings actionable:
1. Map the Trust Chain
Start by mapping how certificates are issued, managed, and revoked in your environment. Identify any ‘trust all’ configurations that bypass certificate validation. These are the lowest-hanging fruit for improving security posture.
2. Segment by Function, Not Just Protocol
Traditional network segmentation based on IP subnets is insufficient for OPC UA. Instead, segment by function and data sensitivity. Use firewalls that understand OPC UA semantics to allow only necessary method calls between zones. This reduces the blast radius if a single endpoint is compromised.
3. Implement Continuous Compliance Monitoring
Deploy monitoring tools that can continuously verify that OPC UA endpoints are adhering to security policies. Look for solutions that provide real-time visibility into certificate expiration, unauthorized access attempts, and protocol violations. This moves you from a reactive ‘point-in-time’ assessment model to a proactive, continuous compliance posture.
This approach aligns with the broader Red Trident philosophy: assessment should identify risk without creating operational risk. By focusing on passive visibility and contextual analysis, you can build a defensible security roadmap that respects the realities of industrial operations.
The Human Element: Policy and Procedure
Technology alone cannot solve the OPC UA security challenge. The human element remains the most critical factor. In many engagements, we observe that OT engineers are expected to manage complex security infrastructures without adequate training or defined roles.
Consider the following scenario: An engineer discovers an expired certificate on a critical OPC UA server during a routine check. Lacking clear procedures for emergency certificate replacement, they bypass the security policy temporarily to restore communication. This action, while well-intentioned, introduces a significant vulnerability that may persist for weeks or months.
To mitigate this risk, organizations must establish clear OT-specific security policies and runbooks. These documents should define:
- Roles and Responsibilities: Who is responsible for issuing, managing, and revoking OPC UA certificates?
- Procedures for Emergency Access: What is the approved process for temporary security bypasses during critical incidents?
- Audit and Review Cycles: How often should the OPC UA infrastructure be reviewed for compliance with security policies?
Without these foundational elements, even the most advanced technology stack will fail to provide adequate protection. As noted in internal assessment records, incomplete asset inventories and missing OT-specific security policies are recurring issues that undermine security efforts.
Conclusion: Embracing Visibility Over Assumption
OPC UA is a powerful protocol that enables the next generation of industrial connectivity. But its complexity demands a nuanced approach to security. Operators must move beyond the assumption that ‘default settings are secure’ and actively manage the lifecycle of their OPC UA infrastructure.
This requires a shift in mindset: from viewing security as a barrier to production to seeing it as an enabler of safe, continuous operation. By leveraging passive visibility, closing the data fidelity gap, and establishing clear policies, you can build an OT security posture that is both robust and resilient.
At Red Trident, we help industrial operators navigate these complexities with evidence-based assessments and practical roadmaps. If you are struggling to gain visibility into your OPC UA environment or need help prioritizing your remediation efforts, we invite you to schedule a free OT security assessment consultation. Let us help you turn your findings into action.
