To Patch or Not to Patch OT System

To Patch or Not to Patch OT Systems - Daily Dilemmas in Risk Management and Plant Business Continuity

🎙️ Michal Karolak, Chief Engineer, Gas Pipline Operator Poland
📍 Presented at SANS ICS Security Summit 2025

Today's control and monitoring systems for process plants are key solutions for business continuity in industry. Unfortunately, in recent years there has been a clear trend of increasing discovered security vulnerabilities in such solutions on an annual basis. This applies not only to classic operating systems, but also to specific RTOS (Real-Time Operating System) class programmable logic controllers, which are at the heart of OT/SCADA systems, or key engineering and SCADA applications. The very high dynamics in the discovered vulnerabilities of these components forces manufacturers of industrial solutions to release more and more new versions of such software that mitigate the discovered vulnerabilities.

Unfortunately, practice and day-to-day experience with the process of managing such vulnerabilities and security updates shows that uploading software updates for industrial devices mitigates some risks, but in turn generates others. Sometimes this also leads to completely unexpected situations.

View upcoming Summits: https://www.sans.org/u/DuS