Securing Critical Infrastructure Networks: A Practical Checklist for Energy, Utilities, Transport and Government
Oil and gas plants, power substations, water stations, airports, ports and government buildings share one thing: when their network fails or is attacked, the impact reaches far beyond IT. This checklist summarises practical controls that integrators and operators can apply to the network layer, aligned with the principles of IEC 62443 and common national cybersecurity frameworks.
1. Know what is connected
- Keep an up-to-date inventory of every switch, router, access point, camera, PLC and server, with firmware versions.
- Label every port and cable in cabinets and field enclosures.
- Disable unused switch ports.
2. Segment into zones and conduits
| Zone | Examples | Rule |
|---|---|---|
| Control (OT) | PLCs, RTUs, SCADA servers | No direct internet; access only through a controlled conduit |
| Safety and security | CCTV, access control, fire systems | Own VLAN; recording servers protected |
| Business (IT) | Office PCs, email, ERP | Firewalled from OT |
| DMZ | Historians, remote-access gateways | The only bridge between IT and OT |
| Management | Switch and AP management interfaces | Admin workstations only |
3. Harden the network devices
- Change default passwords; use unique credentials per site.
- Use SSH and HTTPS for management; disable Telnet and plain HTTP.
- Use SNMPv3 instead of SNMPv1/v2c.
- Enable port security or 802.1X so unknown devices cannot join.
- Keep firmware up to date from a verified source.
- Send logs to a central Syslog server and keep them.
4. Build in resilience
- Ring or redundant topologies with fast recovery (RSTP/ERPS).
- Dual power inputs on industrial switches and redundant DIN-rail power supplies.
- Wide-temperature, hardened equipment for outdoor cabinets and plant areas.
- Critical spares stored on site or available locally.
5. Control remote access
- Remote access only through a VPN gateway in the DMZ, with multi-factor authentication.
- Time-limited vendor access, recorded and approved.
- No permanent remote-desktop tools on OT machines.
6. Trust the supply chain
- Buy through the official channel with local warranty.
- Verify serial numbers and keep certificates (CE, FCC, RoHS) on file.
- Choose suppliers that can support you locally for the life of the system.
7. Test and review
- Review firewall rules and VLAN access every six months.
- Run failover tests on redundant links and power.
- Train staff to report unknown devices and suspicious activity.
Navijin has delivered industrial switches, Wi-Fi, CCTV and IP telephony to more than ten oil and gas sites. Explore our critical infrastructure solution, check any unit on our product verification page, or request a security-focused design review.