The firewall in the panel

Every OT network diagram I’ve ever seen has a box labeled “firewall.”

Almost none of them say what’s actually in that box.

Here’s what I find when I go look.

The big names

FortiGate, Cisco, Palo Alto, Check Point. More capable, more complex. Deep inspection, central management, threat feeds, the works. Some are rugged models built for the plant. A lot are IT boxes somebody dropped into a substation because corporate already had the license. These usually belong to the IT team, or a dedicated OT security team if the site is lucky.

DIN rail

Phoenix Contact mGuard, Hirschmann EAGLE, Moxa, Siemens SCALANCE S, Westermo. Built for the cabinet. They handle the heat, run on 24VDC, and come with a simple web GUI. These usually belong to the controls team. The engineers and integrators who built the line can stand up a rule without opening a ticket. They tend to get configured once and never touched again.

So two very different worlds. One team has the tools but doesn’t know the process. The other team knows the process but doesn’t live in firewall rules.

Sometimes I see both. Big vendor at the IT/OT boundary, DIN rail down at the cell. That’s a good day.

And sometimes I see neither.

The old ones, the open source ones, and the ones that aren’t firewalls

Tofino boxes from 2012 still in a panel with firmware nobody has looked at since install day.

pfSense. OPNsense. On a mini PC sitting on top of the cabinet. I’ve seen it more than people want to admit. Sometimes it’s the best-managed firewall on the site because one engineer actually cares about it. Sometimes it’s a single point of failure that only one person knows how to log into.

And the most common one of all. A managed switch with an ACL that someone calls a firewall.

The part nobody wants to hear

You can buy the most expensive, most capable firewall on this list and it won’t do a thing for you if it’s configured badly.

• ANY/ANY rules “just to get it working” during commissioning. Never removed.
• Management interface wide open to the whole network. Default creds still on it.
• No rules between zones. The HMI network can talk to the safety network.
• IT and OT on either side of the box with nothing actually restricted between them.

That’s not a firewall. That’s a $20,000 router.

Brand only matters once the basics are equal. Get to a real least privilege policy first. Every rule has a reason, every zone is restricted, management is locked down, and someone reviews it. Then we can argue FortiGate vs Palo vs mGuard. Until then, the brand on the box is the least important thing about it.

And know what happens when it fails. Fail open or fail closed? Most sites can’t tell me.

What’s in your panel?

If you can’t answer who owns the rule set, when it was last reviewed, and what it actually allows between IT and OT, that’s where to start. It’s the first thing we look at in an OT assessment, and it’s a conversation we’re happy to have: get in touch.

Watch the 90 second version: That’s Not a Firewall. This article first ran on the PrOTect IT All blog, the podcast I host on OT and critical infrastructure security.