{"id":16256,"date":"2026-11-07T10:55:06","date_gmt":"2026-11-07T09:55:06","guid":{"rendered":"https:\/\/safewave.ai\/ot-ics-security\/"},"modified":"2026-11-09T15:15:43","modified_gmt":"2026-11-09T14:15:43","slug":"ot-ics-security","status":"publish","type":"page","link":"https:\/\/safewave.ai\/en\/ot-ics-security\/","title":{"rendered":"OT \/ ICS Security"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"16256\" class=\"elementor elementor-16256 elementor-15993\" data-elementor-post-type=\"page\">\n\t\t\t\t<section class=\"elementor-element elementor-element-ccb44fd e-flex e-con-boxed e-con e-parent\" data-id=\"ccb44fd\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f75ba4b elementor-widget elementor-widget-heading\" data-id=\"f75ba4b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p class=\"elementor-heading-title elementor-size-default\">OT \/ ICS Security<\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ab3aac4 elementor-widget elementor-widget-heading\" data-id=\"ab3aac4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">An attack on a controller starts with a simple login<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ae88c76 elementor-widget elementor-widget-text-editor\" data-id=\"ae88c76\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>In December 2025, attackers damaged control devices in over 30 wind and photovoltaic farms in Poland. The way was opened by VPNs without multi-factor authentication and default passwords.<sup><a href=\"#przypis-1\">1<\/a><\/sup> We protect industrial networks where it begins \u2013 at the access point: MFA also in networks disconnected from the internet, and cross-zone account control with Silverfort, plus personal YubiKey hardware keys instead of shared passwords.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-6dc281e e-flex e-con-full e-con e-child\" data-id=\"6dc281e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2ff3e2d elementor-widget elementor-widget-button\" data-id=\"2ff3e2d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/safewave.ai\/en\/#SafeWave-get-in-touch\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t<span class=\"elementor-button-icon\">\n\t\t\t\t<svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-arrow-circle-right\" viewBox=\"0 0 512 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M256 8c137 0 248 111 248 248S393 504 256 504 8 393 8 256 119 8 256 8zm-28.9 143.6l75.5 72.4H120c-13.3 0-24 10.7-24 24v16c0 13.3 10.7 24 24 24h182.6l-75.5 72.4c-9.7 9.3-9.9 24.8-.4 34.3l11 10.9c9.4 9.4 24.6 9.4 33.9 0L404.3 273c9.4-9.4 9.4-24.6 0-33.9L271.6 106.3c-9.4-9.4-24.6-9.4-33.9 0l-11 10.9c-9.5 9.6-9.3 25.1.4 34.4z\"><\/path><\/svg>\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Assess OT Risk<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e98986e elementor-widget elementor-widget-button\" data-id=\"e98986e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"#jak-dziala\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">How It Works<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fd9726a elementor-widget elementor-widget-html\" data-id=\"fd9726a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"sw-vendors\"><span class=\"sw-vendors__label\">Technologies<\/span><ul class=\"sw-vendors__list\" aria-label=\"Technologie\"><li class=\"sw-vl\" style=\"--a:1;--w:4.3182;--ih:3.4091;--ox:1.25;--oy:1.2727\"><a href=\"https:\/\/www.silverfort.com\/\" target=\"_blank\" rel=\"noopener\" title=\"Silverfort \u2013 vendor website (new tab)\"><img src=\"https:\/\/safewave.ai\/wp-content\/uploads\/2025\/03\/11.png\" alt=\"Silverfort\" width=\"300\" height=\"150\" decoding=\"async\"><\/a><\/li><li class=\"sw-vl\" style=\"--a:0.95;--w:3.5557;--ih:4.0714;--ox:2.3071;--oy:1.6286\"><a href=\"https:\/\/www.yubico.com\/\" target=\"_blank\" rel=\"noopener\" title=\"Yubico \u2013 vendor website (new tab)\"><img src=\"https:\/\/safewave.ai\/wp-content\/uploads\/2025\/03\/15.png\" alt=\"Yubico\" width=\"300\" height=\"150\" decoding=\"async\"><\/a><\/li><\/ul><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-4a901c3 e-flex e-con-boxed e-con e-parent\" data-id=\"4a901c3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7809b07 elementor-widget elementor-widget-heading\" data-id=\"7809b07\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What the data shows<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-db7eb32 e-flex e-con-full e-con e-child\" data-id=\"db7eb32\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-e37dce3 e-flex e-con-full e-con e-child\" data-id=\"e37dce3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-71d1327 elementor-widget elementor-widget-heading\" data-id=\"71d1327\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p class=\"elementor-heading-title elementor-size-default\">30+<\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad64398 elementor-widget elementor-widget-text-editor\" data-id=\"ad64398\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>wind and photovoltaic farms were attacked on December 29, 2025.<\/strong> According to the CERT Polska report, attackers logged in using, among other things, default accounts for RTU controllers, security devices, and HMI computers.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d48561e e-flex e-con-full e-con e-child\" data-id=\"d48561e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4568029 elementor-widget elementor-widget-text-editor\" data-id=\"4568029\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"sw-stat\"><p class=\"sw-num\">0.5 million<\/p><p class=\"sw-txt\">heat consumers are supplied by the combined heat and power plant, which was one of the targets of the same attack.<sup><a href=\"#przypis-2\">2<\/a><\/sup><\/p><\/div><div class=\"sw-stat\"><p class=\"sw-num\">1 VPN account<\/p><p class=\"sw-txt\">likely had access to all segregated subnets of the facility.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><\/div><div class=\"sw-stat\"><p class=\"sw-num\">100%<\/p><p class=\"sw-txt\">of attacked RES farms had a VPN interface accessible from the internet and login without MFA.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><\/div><div class=\"sw-stat\"><p class=\"sw-num\">5 months<\/p><p class=\"sw-txt\">passed from the exfiltration of the entire Active Directory database of the combined heat and power plant (second half of July 2025) to the attack on December 29.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-81eb188 elementor-widget elementor-widget-text-editor\" data-id=\"81eb188\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>Conclusion:<\/strong> the weakest link was not the industrial technology itself, but access to it \u2013 a password without a second factor, shared accounts, and one account with access to all subnets.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-d1c64c3 e-flex e-con-boxed e-con e-parent\" data-id=\"d1c64c3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-f5bfee3 e-flex e-con-full e-con e-child\" data-id=\"f5bfee3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-929b6c2 elementor-widget elementor-widget-heading\" data-id=\"929b6c2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How industrial networks are attacked \u2013 six scenarios<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-eb853e5 elementor-widget elementor-widget-text-editor\" data-id=\"eb853e5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Scenarios from the CERT Polska report on the attack on Polish energy infrastructure and from vendor materials. In most cases, the attacker does not break OT security \u2013 they exploit access that someone left open. For each: what our technology does in this area.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-47da1de e-flex e-con-full e-con e-child\" data-id=\"47da1de\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6b4d74d elementor-widget elementor-widget-text-editor\" data-id=\"6b4d74d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"sw-item\"><h3>VPN protected by password only<\/h3><p>In the attacked facilities, the VPN interface was accessible from the internet and allowed login without MFA.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><p class=\"sw-fix\"><strong>Silverfort:<\/strong> controls access at the IT\/OT interface (Zone 3.5) and enforces FIDO2 MFA for access to engineering workstations, SCADA servers, and other production resources.<sup><a href=\"#przypis-3\">3<\/a><\/sup><\/p><\/div><div class=\"sw-item\"><h3>Same passwords across multiple facilities<\/h3><p>According to CERT Polska, the industry practice of using the same accounts and passwords in multiple locations may have facilitated the takeover of subsequent devices.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><p class=\"sw-fix\"><strong>YubiKey:<\/strong> a personal hardware key instead of a shared password \u2013 and touching the key confirms that a human is present at the workstation.<sup><a href=\"#przypis-4\">4<\/a><\/sup><\/p><\/div><div class=\"sw-item\"><h3>One account for all subnets<\/h3><p>Networks were segregated, but one VPN account likely had access to all subnets \u2013 segmentation existed only on paper.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><p class=\"sw-fix\"><strong>Silverfort:<\/strong> maps administrator and service accounts that connect between zones and restricts them to designated resources \u2013 a \u201cvirtual fence\u201d instead of access to everything.<sup><a href=\"#przypis-3\">3<\/a><\/sup><\/p><\/div><div class=\"sw-item\"><h3>Default password in device<\/h3><p>RTU controllers, security devices, HMI computers, and port servers were taken over by logging in with default accounts. Data-destroying software was launched on the HMIs.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><p class=\"sw-fix\"><strong>SafeWave:<\/strong> as a first step, we inventory and change default passwords in controllers, HMIs, and port servers. Where login goes through Active Directory, Silverfort adds MFA.<\/p><\/div><div class=\"sw-item\"><h3>Stolen password database from domain controller<\/h3><p>In the combined heat and power plant, the attacker targeted Kerberos with the Rubeus tool, and in the second half of July 2025, exfiltrated the entire Active Directory database. Then they searched for systems with \u201cscada\u201d in the name and tried to connect via RDP to subsequent machines.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><p class=\"sw-fix\"><strong>Silverfort:<\/strong> enforces MFA for Active Directory authentications \u2013 including NTLM and Kerberos \u2013 so a compromised password alone is not enough to log in to protected workstations and servers.<sup><a href=\"#przypis-5\">5<\/a><\/sup><\/p><\/div><div class=\"sw-item\"><h3>Zone without internet, so no MFA<\/h3><p>Production networks often lack internet connectivity, so cloud-based MFA doesn&#8217;t work. The lack of MFA then becomes an \u201cexception\u201d that remains for years.<\/p><p class=\"sw-fix\"><strong>Silverfort and YubiKey:<\/strong> Silverfort extends MFA to all Active Directory authentications, even in completely disconnected networks, using FIDO2 keys.<sup><a href=\"#przypis-5\">5<\/a><\/sup> YubiKey does not require batteries, power, or cellular connectivity.<sup><a href=\"#przypis-4\">4<\/a><\/sup><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-e0311f2 e-flex e-con-boxed e-con e-parent\" data-id=\"e0311f2\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-da41508 elementor-widget elementor-widget-heading\" data-id=\"da41508\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Where OT protection usually ends<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2604e54 elementor-widget elementor-widget-text-editor\" data-id=\"2604e54\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"sw-lead\">A firewall between the office and the plant floor is standard today. But in the attack on Polish RES farms, the entry point was precisely the firewall \u2013 with a VPN accessible from the internet and login without MFA.<sup><a href=\"#przypis-1\">1<\/a><\/sup><\/p><div class=\"sw-cols\"><div class=\"sw-card sw-ok\"><h3>Usually in place:<\/h3><ul><li>Firewall between IT and OT networks<\/li><li>VPN for service and suppliers<\/li><li>Passwords for engineering workstations<\/li><\/ul><\/div><div class=\"sw-card sw-gap\"><h3>Usually missing:<\/h3><ul><li>MFA for VPN and supplier access<\/li><li>Separate accounts instead of shared ones<\/li><li>Account restrictions to designated zones<\/li><li>MFA in networks without internet<\/li><li>Changing default passwords in devices<\/li><\/ul><\/div><\/div><p class=\"sw-note\">Segmentation without identity control is like a door with a lock, where everyone who knows the shared password has the key.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-2ad6b58 e-flex e-con-boxed e-con e-parent\" data-id=\"2ad6b58\" data-element_type=\"container\" data-e-type=\"container\" id=\"jak-dziala\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4ec01bd elementor-widget elementor-widget-heading\" data-id=\"4ec01bd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p class=\"elementor-heading-title elementor-size-default\">Silverfort<\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ab27e4b elementor-widget elementor-widget-heading\" data-id=\"ab27e4b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">MFA and account control at the IT\/OT interface<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c24551 elementor-widget elementor-widget-text-editor\" data-id=\"9c24551\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"sw-lead\">Silverfort protects Active Directory authentications without agents and without system changes \u2013 even in networks completely disconnected from the internet. In OT, it controls access at the IT\/OT interface (Zone 3.5) and enforces MFA for access to resources in Zones 2 and 3.<sup><a href=\"#przypis-3\">3<\/a><\/sup><\/p><div class=\"sw-tiles\"><div class=\"sw-tile\"><h3>Zone 3.5<\/h3><p>A single decision point for who enters the industrial network and under what conditions.<\/p><\/div><div class=\"sw-tile\"><h3>MFA for workstations and SCADA<\/h3><p>Second factor for logging into engineering workstations and servers in Zones 2 and 3.<\/p><\/div><div class=\"sw-tile\"><h3>Agentless<\/h3><p>MFA for NTLM, Kerberos, and LDAP authentications \u2013 without installing anything on workstations.<sup><a href=\"#przypis-5\">5<\/a><\/sup><\/p><\/div><div class=\"sw-tile\"><h3>Isolated networks<\/h3><p>MFA works without the cloud and without internet connectivity.<\/p><\/div><div class=\"sw-tile\"><h3>Service accounts<\/h3><p>\u201cVirtual fence\u201d: the account only operates where it transfers operational data.<\/p><\/div><div class=\"sw-tile\"><h3>Administrators between zones<\/h3><p>Map administrators connecting between zones and restrict them to designated resources.<\/p><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-ac5729a e-flex e-con-boxed e-con e-parent\" data-id=\"ac5729a\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-d15d5b8 e-flex e-con-full e-con e-child\" data-id=\"d15d5b8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8ee1aea elementor-widget elementor-widget-heading\" data-id=\"8ee1aea\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">YubiKey \u2013 a hardware key instead of a shared password<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d7658d8 elementor-widget elementor-widget-text-editor\" data-id=\"d7658d8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The second factor must work on the plant floor: no phone, no battery, and no signal. YubiKey keys work without power and cellular connectivity, and one key supports FIDO2 and smart card (PIV).<sup><a href=\"#przypis-4\">4<\/a><\/sup><\/p><p>A personal key instead of a shared password also means that each login can be attributed to a specific person.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-927eecf e-flex e-con-full e-con e-child\" data-id=\"927eecf\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-84156a3 elementor-widget elementor-widget-text-editor\" data-id=\"84156a3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3>What YubiKey brings<\/h3><ul><li><strong>No battery or connectivity:<\/strong> works in zones without internet and without signal.<sup><a href=\"#przypis-4\">4<\/a><\/sup><\/li><li><strong>FIDO2 and PIV in one:<\/strong> the same key for newer and older systems.<\/li><li><strong>Resistant to conditions:<\/strong> IP68 ingress protection rating \u2013 dust and water.<\/li><li><strong>Human at the workstation:<\/strong> touching the key confirms physical presence.<\/li><li><strong>Together with Silverfort:<\/strong> FIDO2 keys as a second factor also in isolated networks.<sup><a href=\"#przypis-5\">5<\/a><\/sup><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-f536ff9 e-flex e-con-boxed e-con e-parent\" data-id=\"f536ff9\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8bf493c elementor-widget elementor-widget-heading\" data-id=\"8bf493c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What regulations say<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5410bbe elementor-widget elementor-widget-text-editor\" data-id=\"5410bbe\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"sw-law\"><div class=\"sw-law-item\"><h3>NIS2<\/h3><p>Energy and water sectors are considered highly critical (Annex I). Article 21(2) requires, among other things, access control (point (i)) and multi-factor or continuous authentication where appropriate (point (j)).<sup><a href=\"#przypis-6\">6<\/a><\/sup><\/p><\/div><div class=\"sw-law-item\"><h3>KSC Act<\/h3><p>The amendment to Poland&#8217;s National Cybersecurity System Act (KSC Act) implementing NIS2 is effective from April 3, 2026. Essential and important entities have until April 3, 2027, to implement obligations, and managers are also responsible for cybersecurity.<sup><a href=\"#przypis-7\">7<\/a><\/sup><\/p><\/div><div class=\"sw-law-item\"><h3>ISA\/IEC 62443<\/h3><p>A series of standards for the security of industrial automation and control systems, including requirements for systems and security levels. This is not a regulation, but a reference point for OT operators and suppliers.<sup><a href=\"#przypis-8\">8<\/a><\/sup><\/p><\/div><\/div><p class=\"sw-note\">Regulations do not specify products. We help translate them into specific industrial network protections \u2013 and document them for audit purposes.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-29e3d2a e-flex e-con-boxed e-con e-parent\" data-id=\"29e3d2a\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-35c871c e-flex e-con-full e-con e-child\" data-id=\"35c871c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d83c762 elementor-widget elementor-widget-heading\" data-id=\"d83c762\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How we work<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1b219ee elementor-widget elementor-widget-text-editor\" data-id=\"1b219ee\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>SafeWave has been operating since 1998 as a vendor-agnostic integrator. In OT, we work together with the maintenance team: we do not change anything in the production network without an agreed service window.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4b602fb e-flex e-con-full e-con e-child\" data-id=\"4b602fb\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-42951e5 elementor-widget elementor-widget-text-editor\" data-id=\"42951e5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ol class=\"sw-steps\"><li><h3>Inventory of OT access<\/h3><p>We determine which devices and connections are in the industrial network, and who connects to them and how \u2013 including suppliers and service.<\/p><\/li><li><h3>Quick fixes<\/h3><p>First, what was exploited in the attack on Polish energy infrastructure: MFA for VPN and remote access, changing default passwords, separate accounts instead of shared ones.<\/p><\/li><li><h3>Accounts only where needed<\/h3><p>Silverfort maps administrator and service accounts connecting between zones and restricts them to designated resources.<\/p><\/li><li><h3>MFA in production zones<\/h3><p>Silverfort and YubiKey keys for engineering workstations and SCADA servers \u2013 even where there is no internet. We plan implementation together with the maintenance team. Support in English and Polish.<\/p><\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<section class=\"elementor-element elementor-element-261e6ba e-flex e-con-boxed e-con e-parent\" data-id=\"261e6ba\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7dcffdc elementor-widget elementor-widget-heading\" data-id=\"7dcffdc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Check who connects to your industrial network \u2013 and how<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9be9f0c elementor-widget elementor-widget-text-editor\" data-id=\"9be9f0c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Let&#8217;s start with an overview of OT access: VPN, supplier accounts, default passwords, and segmentation. You will receive the conclusions as a list of actions prioritized by risk.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1c98491 elementor-widget elementor-widget-button\" data-id=\"1c98491\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/safewave.ai\/en\/#SafeWave-get-in-touch\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t<span class=\"elementor-button-icon\">\n\t\t\t\t<svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-arrow-circle-right\" viewBox=\"0 0 512 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M256 8c137 0 248 111 248 248S393 504 256 504 8 393 8 256 119 8 256 8zm-28.9 143.6l75.5 72.4H120c-13.3 0-24 10.7-24 24v16c0 13.3 10.7 24 24 24h182.6l-75.5 72.4c-9.7 9.3-9.9 24.8-.4 34.3l11 10.9c9.4 9.4 24.6 9.4 33.9 0L404.3 273c9.4-9.4 9.4-24.6 0-33.9L271.6 106.3c-9.4-9.4-24.6-9.4-33.9 0l-11 10.9c-9.5 9.6-9.3 25.1.4 34.4z\"><\/path><\/svg>\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Schedule an OT Review<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/section>\n\t\t<aside class=\"elementor-element elementor-element-f087df3 e-flex e-con-boxed e-con e-parent\" data-id=\"f087df3\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c292d6c elementor-widget elementor-widget-text-editor\" data-id=\"c292d6c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"sw-h\">Sources<\/p><ol class=\"sw-src-list\"><li id=\"przypis-1\"><a href=\"https:\/\/cert.pl\/uploads\/docs\/CERT_Polska_Raport_Incydent_Sektor_Energii_2025.pdf\" target=\"_blank\" rel=\"noopener\">CERT Polska, report on the energy sector incident (29.12.2025)<\/a><\/li><li id=\"przypis-2\"><a href=\"https:\/\/www.gov.pl\/web\/energia\/cyberatak-na-infrastrukture-sektora-energii-w-polsce-opublikowano-szczegolowy-raport-cert-polska\" target=\"_blank\" rel=\"noopener\">Ministry of Energy, \u201cCyberattack on energy sector infrastructure in Poland,\u201d 2.02.2026<\/a><\/li><li id=\"przypis-3\"><a href=\"https:\/\/www.silverfort.com\/use-cases\/ot-networks\" target=\"_blank\" rel=\"noopener\">Silverfort, OT network protection<\/a><\/li><li id=\"przypis-4\"><a href=\"https:\/\/www.yubico.com\/resource\/securing-operational-technology-with-yubico\/\" target=\"_blank\" rel=\"noopener\">Yubico, \u201cSecuring Operational Technology with Yubico\u201d<\/a><\/li><li id=\"przypis-5\"><a href=\"https:\/\/www.silverfort.com\/resources\/silverfort-mfa-for-air-gapped-networks\" target=\"_blank\" rel=\"noopener\">Silverfort, MFA for isolated (air-gapped) networks<\/a><\/li><li id=\"przypis-6\"><a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj\" target=\"_blank\" rel=\"noopener\">Directive (EU) 2022\/2555 (NIS2)<\/a><\/li><li id=\"przypis-7\"><a href=\"https:\/\/www.gov.pl\/web\/cyfryzacja\/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa-zaczyna-obowiazywac\" target=\"_blank\" rel=\"noopener\">Ministry of Digital Affairs, amendment to the KSC Act<\/a><\/li><li id=\"przypis-8\"><a href=\"https:\/\/www.isa.org\/standards-and-publications\/isa-standards\/isa-iec-62443-series-of-standards\" target=\"_blank\" rel=\"noopener\">ISA, ISA\/IEC 62443 series of standards<\/a><\/li><\/ol><p class=\"sw-asof\">As of November 7, 2026. Product descriptions are based on vendor materials.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/aside>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>OT \/ ICS Security: MFA even in isolated networks, hardware keys instead of shared passwords, access to designated zones. Silverfort, Yubico.<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"footnotes":""},"class_list":["post-16256","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>OT \/ ICS Security &#8211; SafeWave<\/title>\n<meta name=\"description\" content=\"OT \/ ICS Security: MFA even in isolated networks, hardware keys instead of shared passwords, access to designated zones. Silverfort, Yubico.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/safewave.ai\/en\/ot-ics-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OT \/ ICS Security &#8211; SafeWave\" \/>\n<meta property=\"og:description\" content=\"OT \/ ICS Security: MFA even in isolated networks, hardware keys instead of shared passwords, access to designated zones. Silverfort, Yubico.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/safewave.ai\/en\/ot-ics-security\/\" \/>\n<meta property=\"og:site_name\" content=\"SafeWave\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-09T14:15:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/safewave.ai\/wp-content\/uploads\/2025\/03\/11.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/ot-ics-security\\\/\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/ot-ics-security\\\/\",\"name\":\"OT \\\/ ICS Security &#8211; SafeWave\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/ot-ics-security\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/ot-ics-security\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/11.png\",\"datePublished\":\"2026-11-07T09:55:06+00:00\",\"dateModified\":\"2026-11-09T14:15:43+00:00\",\"description\":\"OT \\\/ ICS Security: MFA even in isolated networks, hardware keys instead of shared passwords, access to designated zones. Silverfort, Yubico.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/ot-ics-security\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/safewave.ai\\\/en\\\/ot-ics-security\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/ot-ics-security\\\/#primaryimage\",\"url\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/11.png\",\"contentUrl\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/11.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/ot-ics-security\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OT \\\/ ICS Security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\",\"name\":\"SafeWave\",\"description\":\"We protect your AI models, data, applications, systems and users. Also in the cloud and based on cloud\",\"publisher\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#organization\"},\"alternateName\":\"SafeWave sp. z o.o.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/safewave.ai\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#organization\",\"name\":\"SafeWave\",\"alternateName\":\"SafeWave sp. z o.o.\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/SafeWave-BLACK_350.png\",\"contentUrl\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/SafeWave-BLACK_350.png\",\"width\":350,\"height\":270,\"caption\":\"SafeWave\"},\"image\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/safewave-ai\",\"https:\\\/\\\/www.youtube.com\\\/@SafeWaveAI\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"OT \/ ICS Security &#8211; SafeWave","description":"OT \/ ICS Security: MFA even in isolated networks, hardware keys instead of shared passwords, access to designated zones. Silverfort, Yubico.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/safewave.ai\/en\/ot-ics-security\/","og_locale":"en_US","og_type":"article","og_title":"OT \/ ICS Security &#8211; SafeWave","og_description":"OT \/ ICS Security: MFA even in isolated networks, hardware keys instead of shared passwords, access to designated zones. Silverfort, Yubico.","og_url":"https:\/\/safewave.ai\/en\/ot-ics-security\/","og_site_name":"SafeWave","article_modified_time":"2026-11-09T14:15:43+00:00","og_image":[{"url":"https:\/\/safewave.ai\/wp-content\/uploads\/2025\/03\/11.png","type":"","width":"","height":""}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/safewave.ai\/en\/ot-ics-security\/","url":"https:\/\/safewave.ai\/en\/ot-ics-security\/","name":"OT \/ ICS Security &#8211; SafeWave","isPartOf":{"@id":"https:\/\/safewave.ai\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/safewave.ai\/en\/ot-ics-security\/#primaryimage"},"image":{"@id":"https:\/\/safewave.ai\/en\/ot-ics-security\/#primaryimage"},"thumbnailUrl":"https:\/\/safewave.ai\/wp-content\/uploads\/2025\/03\/11.png","datePublished":"2026-11-07T09:55:06+00:00","dateModified":"2026-11-09T14:15:43+00:00","description":"OT \/ ICS Security: MFA even in isolated networks, hardware keys instead of shared passwords, access to designated zones. Silverfort, Yubico.","breadcrumb":{"@id":"https:\/\/safewave.ai\/en\/ot-ics-security\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/safewave.ai\/en\/ot-ics-security\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/safewave.ai\/en\/ot-ics-security\/#primaryimage","url":"https:\/\/safewave.ai\/wp-content\/uploads\/2025\/03\/11.png","contentUrl":"https:\/\/safewave.ai\/wp-content\/uploads\/2025\/03\/11.png"},{"@type":"BreadcrumbList","@id":"https:\/\/safewave.ai\/en\/ot-ics-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/safewave.ai\/en\/"},{"@type":"ListItem","position":2,"name":"OT \/ ICS Security"}]},{"@type":"WebSite","@id":"https:\/\/safewave.ai\/en\/#website","url":"https:\/\/safewave.ai\/en\/","name":"SafeWave","description":"We protect your AI models, data, applications, systems and users. Also in the cloud and based on cloud","publisher":{"@id":"https:\/\/safewave.ai\/en\/#organization"},"alternateName":"SafeWave sp. z o.o.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/safewave.ai\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/safewave.ai\/en\/#organization","name":"SafeWave","alternateName":"SafeWave sp. z o.o.","url":"https:\/\/safewave.ai\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/safewave.ai\/en\/#\/schema\/logo\/image\/","url":"https:\/\/safewave.ai\/wp-content\/uploads\/2022\/05\/SafeWave-BLACK_350.png","contentUrl":"https:\/\/safewave.ai\/wp-content\/uploads\/2022\/05\/SafeWave-BLACK_350.png","width":350,"height":270,"caption":"SafeWave"},"image":{"@id":"https:\/\/safewave.ai\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/safewave-ai","https:\/\/www.youtube.com\/@SafeWaveAI"]}]}},"_links":{"self":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/pages\/16256","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/comments?post=16256"}],"version-history":[{"count":3,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/pages\/16256\/revisions"}],"predecessor-version":[{"id":16489,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/pages\/16256\/revisions\/16489"}],"wp:attachment":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/media?parent=16256"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}