The Cyber Defence Simulation in the Energy Sector (Ex4S'26), held by EPDK, the Energy Market Regulatory Authority in Türkiye, on 6–7 October, was widely discussed in the sector. The topic isn't limited to energy companies; the same risks apply to every factory that uses PLCs and SCADA.
The gaps we see most often in the field, and what to do first:
- Network separation: The production network (PLC, HMI, SCADA) should be separate from the office network, with traffic between them passing through a firewall under defined rules.
- Remote access: The connection of the machine builder or service company should not be left permanently open; it should be granted via VPN, logged and time-limited.
- Inventory: Which device runs which software version? You can't protect a device you don't know about.
- Backup: An up-to-date backup of PLC programs and SCADA projects should be kept somewhere separate from the network.
- Monitoring: A setup that logs traffic and events on the OT network; when something happens, this is where the answer to "what happened?" comes from.
Most of this doesn't require a big investment; it takes the right configuration and regular maintenance.
At SMB Teknoloji we work on OT network separation, secure remote access and managing the PLC/SCADA side together with IT in industrial plants.