The attacks on refrigeration controllers, including Danfoss systems, raise an uncomfortable question: why can someone outside the business get anywhere near equipment that keeps the business running?
CERT-FR has confirmed compromises and warned against exposing management interfaces to the internet. Separately, Danfoss has documented an authentication-bypass flaw. A stronger password won't fix a login that can be bypassed.
Keeping vulnerable industrial equipment running behind a tightly controlled boundary is an established approach. You don't have to replace every controller before you can take away its direct exposure.
Here's how we'd approach this with AIC Enterprise Privilege Suite™.
Treat the OT network as untrusted. Assume somebody may already have a foothold. Isolate it from other networks, control traffic in both directions, and make the PAM gateway the only route for outside administration. Give technicians access through AIC to an approved management workstation inside that boundary.
Our low-cost PAM gateway runs on Linux. It can run on hardware as small as a Raspberry Pi, so the gateway hardware can be a very small expense compared with replacing working industrial equipment.
Require an individual identity, MFA and approval. Limit the session and record the supported remote desktop connection. The technician can do the job without leaving the controller open to everybody else.
An attacker relying on direct access to the controller's vulnerable management interface would be blocked by that boundary. That's the prevention opportunity here, provided every alternate route is closed. The exact entry path in the October attacks remains unconfirmed in the reports reviewed.
Isolation contains exposure; it doesn't remove an intruder already inside. The gateway and management workstation need protecting too.
For those running OT, what's stopping you from putting controlled access in front of the equipment you can't replace? Is it the cost, the vendor, or keeping emergency maintenance workable?
Our approach to OT access: https://analoginfo.com/operational-technology