What breaks when manufacturing teams rely on shared credentials and legacy authentication in OT environments?

Why This Matters for Security Teams

In OT environments, shared credentials and legacy authentication do more than weaken access control. They erase the link between an action and a specific operator, workstation, or remote session, which makes investigations slower and containment more uncertain. That is especially dangerous in plants where HMIs, engineering workstations, historians, and vendor support paths all touch the same control plane. Guidance from the OWASP Non-Human Identity Top 10 maps closely to this problem because unmanaged access is still access, even when it sits outside traditional user accounts.

The risk is not only insider misuse. Legacy authentication protocols and shared logins make it easier for attackers to blend into normal operations, reuse access across zones, and persist after a single password change. NHIMG research on the Guide to the Secret Sprawl Challenge shows how quickly secrets proliferate once teams rely on convenience instead of task-bound access. In practice, many security teams discover this only after a maintenance account has been reused across multiple suppliers or a compromise has already spread beyond one cell.

How It Works in Practice

Shared credentials usually fail first at the point where OT teams need speed: shift changes, emergency maintenance, and vendor troubleshooting. A common pattern is one account for an HMI, one for an engineering workstation, and one remote access credential passed among contractors. That keeps production moving, but it destroys attribution and makes revocation blunt. If a password is changed, every dependent workflow breaks. If it is not changed, the attacker keeps the same pathway.

Legacy authentication adds a second weakness. Older protocols often authenticate the session, not the person or the task. They may not support modern claims-based identity, strong device binding, or step-up checks that a Zero Trust design would expect. NIST’s SP 800-53 Rev. 5 Security and Privacy Controls and SP 800-63 Digital Identity Guidelines both reinforce stronger identity assurance, but OT implementations often need compensating controls when protocol upgrades are slow.

• Replace shared logins with named operator access where the platform allows it.
• Use time-limited credentials for remote support, maintenance, and supplier access.
• Segment HMIs, historians, and engineering workstations so one password cannot reach everything.
• Log session context, not just successful authentication, so activity can be tied to a task.
• Wrap legacy protocols with gateways, jump hosts, or brokered access when native controls are unavailable.

NHIMG’s 2024 Non-Human Identity Security Report found that 88.5% of organisations say their non-human IAM practices lag behind or merely match human IAM, which mirrors the OT reality where access control is still treated as an administrative convenience. These controls tend to break down when plants depend on unmanaged vendor laptops and always-on remote support tunnels because the legacy path bypasses the very identity checks the environment needs.

Common Variations and Edge Cases

Tighter access control often increases operational overhead, so organisations must balance plant uptime against traceability and containment. That tradeoff is real in brownfield OT, where older PLCs, serial gateways, and vendor-managed services cannot always support modern identity features. Current guidance suggests treating this as a phased modernization problem rather than waiting for a full platform replacement.

One edge case is safety-critical maintenance, where operators argue that shared access is the only practical option during outages. Another is vendor support, where third parties expect persistent access to legacy HMIs or jump servers. In both cases, the safer pattern is not permanent sharing but brokered, short-lived access with approvals, recording, and post-session review. The Ultimate Guide to NHIs is useful here because the same static-vs-dynamic secrets logic applies in OT: long-lived credentials expand blast radius, while ephemeral access reduces it.

There is no universal standard for this yet across every OT stack, especially where device identities, human operators, and machine-to-machine sessions overlap. The practical benchmark is simple: if a credential cannot be tied to one task, one time window, and one accountable session, it is too reusable for a resilient plant. In environments with flat networks and unmanaged remote access, that gap becomes the attacker’s shortest path from one workstation to the rest of the operation.

Related resources from NHI Mgmt Group

• How should teams reduce the risk of exposed AI credentials being abused?
• What breaks when shared clinical workstations rely on fragmented authentication tools?
• How should security teams govern access on shared devices in manufacturing environments?
• What breaks when agents rely on shared credentials or borrowed user identities?