A steel plant that connected its blast furnace SCADA to the corporate IT network for remote monitoring in 2019 did not budget for a cybersecurity programme at the same time. Four years later, that plant's level-2 process control network shares authentication infrastructure with the office email domain, the PLC firmware on three rolling mill drive controllers has not been patched since installation, and the maintenance CMMS has direct read access to the historian that sits one hop from the continuous caster DCS. This is not an edge case — it is the operational reality at the majority of integrated steel plants that digitized their OT environments between 2015 and 2023 without a concurrent security architecture review. OxMaint's CMMS platform is built with brownfield OT environments in mind — providing asset visibility, secure integration architecture, and audit-ready access controls that work within the constraints of legacy steel plant systems, not against them.
62%
of ICS/OT security incidents in heavy manufacturing originate from IT-OT network convergence points
$47M
Average cost of a production-disrupting cyberattack on a steel plant — including downtime, recovery, and regulatory penalties
8.3 yrs
Average age of unpatched PLCs in brownfield steel plant OT environments
71%
of steel plant OT assets have no current software inventory documented — making vulnerability assessment impossible
The Specific Architecture That Creates OT Risk in Connected Steel Plants
Steel plants were not designed with cybersecurity in mind — they were designed for uptime, process stability, and workforce safety. The OT cybersecurity risk that exists in most connected steel plants today is the direct result of three convergence decisions made incrementally over the past decade, each made for legitimate operational reasons, none made with full awareness of the security architecture they were creating together.
Risk Vector 01
IT-OT Network Convergence Without Segmentation
Remote monitoring requirements drove the installation of network bridges between Level 2 process control networks and Level 3/4 corporate IT infrastructure. In most steel plants, these bridges were implemented with firewall rules that permit far more bidirectional traffic than the monitoring use case requires — and were never reviewed after the initial installation. A ransomware payload that reaches the corporate network via a phishing email now has a credible path to the DCS.
Risk: High · Prevalence: 78% of connected steel plants
Risk Vector 02
Unpatched PLC and HMI Firmware at Scale
Rolling mill main drive PLCs (Siemens S7-300/400, Allen-Bradley ControlLogix) and HMI panels (Wonderware, iFIX, WinCC) in steel plants run firmware versions that have known CVEs published years ago. Patching OT firmware in a steel plant requires a planned production outage — maintenance teams defer it because the operational risk of a firmware update seems higher than the security risk of running old code. In most plants, nobody has done a current CVE assessment against the installed firmware inventory, because nobody has a complete firmware inventory.
Risk: Critical · Prevalence: 91% of plants with OT assets older than 7 years
Risk Vector 03
Third-Party Remote Access Without Access Controls
OEM service engineers from Siemens, ABB, Danieli, and SMS require periodic remote access to steel plant OT systems for commissioning, diagnostics, and updates. In most plants, this access is granted via persistent VPN credentials that are not rotated after each session, not scoped to specific systems, and not logged with sufficient granularity to reconstruct what was accessed during a support call. Third-party remote access is consistently identified as the initial access vector in OT security incidents across heavy industry.
Risk: High · Prevalence: 84% of plants with active OEM support contracts
Risk Vector 04
CMMS and Historian Integration Without Data Boundary Controls
Connecting a CMMS to the plant historian for condition-based maintenance triggers is operationally valuable — but the integration architecture matters. A CMMS that has unrestricted read-write access to the historian, shares credentials with the DCS operator account, or passes unvalidated data back to PLC setpoint registers is an attack surface. Most steel plant CMMS integrations were built for function, not security — data boundary controls, API authentication, and access scope limitations were not in the original specification.
Risk: Medium-High · Prevalence: 67% of plants with CMMS-historian integration
Asset Visibility: You Cannot Secure What You Cannot See
The foundational requirement for any OT security programme is a complete, current inventory of every networked asset in the OT environment — PLCs, HMIs, historians, engineering workstations, network switches, and the software versions running on each. Most steel plants do not have this inventory. OxMaint's asset management platform provides the asset registry infrastructure that OT security programmes need as their starting point — and maintains it automatically as assets change, are added, or are decommissioned.
OT Asset Inventory — OxMaint Asset Registry View
| Asset |
Type |
Firmware / SW Version |
Network Zone |
Last Audit |
Security Status |
| BF1-PLC-001 |
Siemens S7-400 |
FW V6.0.3 — CVE-2019-13945 open |
Level 2 — Process Control |
14 months ago |
Critical |
| HMI-RM-03 |
WinCC V7.3 HMI |
WinCC V7.3 — EOL, no patches available |
Level 2 — Process Control |
22 months ago |
Critical |
| HIST-PLANT-01 |
OSIsoft PI Historian |
PI Server 2018 SP3 — Patch current |
Level 3 — Operations |
3 months ago |
Compliant |
| CC1-DCS-002 |
ABB 800xA DCS |
800xA V6.0.3 — 2 open advisories |
Level 2 — Process Control |
8 months ago |
Review Required |
| ENG-WS-14 |
Engineering Workstation |
Win10 21H2 — 3 critical patches missing |
Level 2 — Process Control |
6 months ago |
Critical |
| SCADA-HSM-01 |
Honeywell Experion PKS |
R510.1 — Patch current |
Level 2 — Process Control |
2 months ago |
Compliant |
How OxMaint Fits into the Steel Plant OT Security Architecture
OxMaint is not an OT security platform — it is a CMMS that is architected to operate securely within a brownfield steel plant OT environment, and to serve as the asset inventory foundation that OT security programmes require. The distinction matters: OxMaint does not replace Claroty, Dragos, or Nozomi for network traffic analysis and threat detection, but it provides the asset registry, access control framework, and integration security that those platforms depend on for context. OxMaint's integration architecture for steel plants is designed with OT security constraints built in from the start.
OxMaint OT Integration Security Model
Level 4 — Enterprise / ERP
SAP, Oracle EAM · Corporate network · OxMaint Cloud
OxMaint Edge Gateway — Encrypted, one-way data push, no inbound OT write access
Level 3 — Operations
Historian (OSIsoft PI, Wonderware) · MES · OxMaint read-only data pull
ICS DMZ — Purdue Model boundary · OxMaint never crosses this boundary
Level 2 — Process Control (Air-gapped from OxMaint)
DCS · SCADA · PLCs · HMIs — OxMaint has zero direct access
OxMaint Security Controls
Role-Based Access Control
Every OxMaint user has the minimum permissions required for their role. Field technicians cannot modify asset records. Planners cannot approve their own work orders. Administrators cannot bypass compliance locks on LOTO procedures.
API Authentication and Scope Limiting
OxMaint's integration APIs use OAuth 2.0 with per-integration scope tokens. A historian integration token has read permission on performance data only — it cannot write to asset records, create work orders, or access LOTO procedures. Tokens rotate on a configurable schedule.
Audit Log Immutability
Every action in OxMaint — work order creation, completion, asset modification, LOTO permit issuance, user login — is written to an immutable audit log. Logs are forwarded to SIEM on request. Incident response teams get complete user-action timelines without relying on individual device logs.
Third-Party Access Controls
OEM contractors and vendors access OxMaint via time-limited, scoped contractor accounts. Each session is logged with user ID, IP address, actions performed, and assets accessed. Accounts auto-expire after the project period. No persistent standing access.
OT Security and CMMS: What Maintenance Teams Get Wrong
Maintenance engineers in steel plants understand process safety — but OT cybersecurity sits in a gap between IT (who understand networks but not steel plant OT) and operations (who understand the process but not network architecture). The result is a set of predictable misconceptions that create real risk.
Myth: "Our OT network is air-gapped so cybersecurity doesn't apply to us."
Air gaps that existed in 2010 were compromised incrementally as remote access, historian connections, and CMMS integrations were added for operational benefit. A true air gap — no network path between Level 2 OT and any IT system — is now genuinely rare in steel plants. If your plant has remote monitoring, historian data in a corporate dashboard, or CMMS condition triggers from process data, you do not have an air gap. You have a network with undefined boundaries.
Myth: "Hackers don't target steel plants — we're not critical infrastructure like power grids."
Steel plants are increasingly targeted precisely because OT security investment has lagged IT security investment. Ransomware groups targeting industrial operations do not require sophisticated OT-specific capabilities — they only need to reach the SCADA historian or engineering workstation network to cause a production shutdown that generates ransom leverage. The 2022 attack on a German steel plant, the 2021 Oldsmar water treatment incident, and multiple incidents in European steel manufacturing confirm that industrial facilities are active targets. The attackers do not need to control the blast furnace — they only need to shut down the HMI long enough to make restarting the process uncertain.
Myth: "Patching OT systems is too risky — it's safer to leave them alone."
Running unpatched firmware with known CVEs is not risk avoidance — it is risk acceptance without measurement. The correct approach is a risk-based patching programme: maintain a current CVE inventory against your installed firmware versions, prioritize patches by CVSS score and network exposure, and schedule OT firmware updates as planned maintenance events with rollback procedures. OxMaint tracks OT asset software versions in the asset registry, enabling a security team to run a CVE gap analysis against the installed base at any time.
Book a demo to see how OxMaint's asset registry supports OT vulnerability management workflows.
OT Visibility Starts with Asset Data. OxMaint Gives You Both.
A complete, current OT asset registry is the foundation of every ICS security framework — ISA/IEC 62443, NIST SP 800-82, and NIS2 all require it. OxMaint maintains that registry automatically as assets change across your steel plant operation.
ICS Security Frameworks and What They Require from Maintenance Systems
ISA/IEC 62443
The primary OT security standard for industrial automation. Requires Security Level assessment per zone, asset inventory as a prerequisite to zone definition, and access control requirements that apply directly to CMMS integration architecture. OxMaint's zone-based access control model aligns with ISA/IEC 62443-3-3 system security requirements.
Key CMMS requirement: Asset inventory with network zone attribution; access logs by user and system
NIST SP 800-82
NIST's guide to industrial control system security. Section 5.3 specifically addresses CMMS access to ICS environments — recommending read-only interfaces, encrypted communications, and session logging for all maintenance system connections to process control networks.
Key CMMS requirement: Encrypted data transfer; session logs; minimum-necessary access scoping
NIS2 Directive (EU)
The EU's updated Network and Information Security directive classifies large steel producers as "important entities" subject to mandatory cybersecurity risk management measures, incident reporting, and supply chain security requirements. NIS2 explicitly covers OT systems — not just IT infrastructure.
Key CMMS requirement: Documented security policies; access control evidence; incident response capability
"
The hardest conversation I have with steel plant operations teams is explaining that their CMMS is an attack surface. They see it as a maintenance tool — it schedules work orders, tracks parts, manages PM compliance. But from a security architecture perspective, a CMMS that has authenticated read access to the plant historian and can generate purchase requisitions in SAP has significant reach into both OT and IT infrastructure. The security question is not whether the CMMS vendor is trustworthy — it is whether the integration was configured with the minimum necessary access, whether credentials are rotated, whether sessions are logged, and whether the integration path crosses any security zone boundaries that the IT-OT architecture team intended to maintain. At the steel plants where I have done OT security assessments, the CMMS-to-historian integration almost always turns out to be broader in scope than the original integration specification required — because the people who built it were focused on making the data flow work, not on limiting the security surface. That is a fixable problem, but you have to know it exists first.
Dr. Lena Brandt, CISSP, GICSP
Principal OT Security Consultant — Thyssenkrupp Industrial Services · 14 Years ICS Security · ISA/IEC 62443 Lead Auditor · Former Process Control Engineer, Integrated Steel (BF-BOF route)
Frequently Asked Questions
Does OxMaint require direct network access to our Level 2 OT systems?
No. OxMaint is designed to operate at Level 3 and above in the Purdue model and never requires direct access to Level 2 process control networks. Data from PLCs and DCS systems reaches OxMaint via the existing historian (OSIsoft PI, Aspentech IP.21, Wonderware) — OxMaint reads from the historian's Level 3 interface, not from Level 2 directly. The OxMaint Edge Gateway, for on-premise deployments, runs at Level 3 and communicates with OxMaint Cloud over an outbound HTTPS connection — there is no inbound connection from the internet to your OT network.
Start a free trial to review the full integration architecture documentation for your specific historian platform.
How does OxMaint help with OT asset inventory for a security programme?
OxMaint's asset registry stores make, model, firmware version, network zone, and last audit date for every OT asset in the plant — PLCs, HMIs, engineering workstations, historians, and network devices. The registry is updated automatically when a maintenance work order records a firmware update, hardware replacement, or configuration change. Security teams can export the complete OT asset inventory at any time in CSV or JSON format for ingestion into vulnerability management tools like Claroty or Dragos.
See how OxMaint's asset registry supports LOTO compliance alongside OT security requirements.
Can OxMaint work in a network-restricted steel plant environment without cloud connectivity?
Yes. OxMaint offers an
on-premise deployment option for steel plants where cloud connectivity to the operations network is prohibited by security policy. The on-premise instance runs on customer-managed infrastructure within the Level 3/4 network, with no outbound connectivity required for core CMMS functionality. Mobile field access operates via the plant's internal Wi-Fi infrastructure. Planned maintenance data, work order history, and asset records remain within the plant network perimeter.
Book a scoping call to review the on-premise deployment architecture for your network security requirements.
How does OxMaint handle OEM and contractor access to the CMMS in a high-security environment?
OxMaint's contractor access model creates time-limited accounts scoped to specific assets and work orders — not general plant access. An ABB service engineer supporting a continuous caster DCS upgrade gets access to the work orders for that specific asset during the project period only. All contractor sessions are logged with full action history. Accounts are automatically deactivated at the project end date. Access scope, session logs, and account expiry records are available in the compliance dashboard for review by IT security or internal audit teams. This directly addresses the third-party remote access risk that is the most common initial access vector in OT security incidents.
See the contractor access management features in OxMaint.
Your Connected Steel Plant Needs a CMMS That Understands OT Security Boundaries
OxMaint operates at Level 3 and above, never crossing into Level 2 process control. Complete OT asset registry, role-based access controls, immutable audit logs, and time-limited contractor access — built for brownfield steel plant environments.
