CoreQ Academy3.5 Given a set of requirements, secure specialized and legacy systems against threats.
Specialized and legacy systems often cannot be patched or run agents, and failures can endanger lives. Security relies on isolation, monitoring and careful change.
System types
- Operational technology (OT)
- Systems that monitor and control physical processes.
- Supervisory control and data acquisition (SCADA)
- Systems supervising geographically distributed processes such as pipelines and grids.
- Industrial control system (ICS)
- Controllers (PLCs, DCS) running industrial processes.
- Heating ventilation and air conditioning (HVAC)/environmental
- Building systems that, if compromised, can cause outages or be a network entry point.
- Internet of Things (IoT)
- Connected devices with weak defaults and limited updates.
- System-on-chip (SoC)
- Integrated processors in devices; firmware and debug interfaces must be locked down.
- Embedded systems
- Purpose-built computers inside devices.
- Wireless technologies/radio frequency (RF)
- Wireless links in specialized systems (Zigbee, LoRa, proprietary RF) that may lack encryption.
Security and privacy considerations
- Segmentation
- Isolate OT/IoT from IT and the internet (Purdue levels, DMZs, data diodes).
- Monitoring
- Passive network monitoring tuned for industrial protocols.
- Aggregation
- Combining device data centrally can create a high-value, sensitive data store.
- Hardening
- Changing defaults, disabling unused services and locking debug ports.
- Data analytics
- Analysing device and process data for anomalies.
- Environmental
- Physical conditions (heat, dust, vibration) that constrain controls.
- Regulatory
- Sector rules such as NERC CIP or FDA guidance for medical devices.
- Safety
- Human and physical safety comes first; security changes must not create safety hazards.
Industry-specific challenges
- Utilities
- Critical infrastructure with long-lived equipment and strict reliability requirements.
- Transportation
- Vehicles, signalling and logistics systems where availability and safety dominate.
- Healthcare
- Medical devices and clinical systems that are hard to patch and handle sensitive data.
- Manufacturing
- Production lines where downtime is extremely costly.
- Financial
- Legacy mainframes and payment systems with strict compliance needs.
- Government/defense
- Classified environments, supply chain scrutiny and nation-state threats.
Characteristics of specialized/legacy systems
- Unable to secure
- Systems that cannot support modern controls; isolate and monitor.
- Obsolete
- Outdated technology still in use.
- Unsupported
- No vendor patches or help.
- Highly constrained
- Limited CPU, memory, power or bandwidth that prevent agents and strong crypto.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 3.5 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.