In 2024, as a representative of the OPC Foundation, I had the pleasure of collaborating on an important document with the U.S. Cyber Security Infrastructure Security Agency (CISA). It was published in January of 2025 under the title, “Secure by Demand: Priority Considerations for Operational Technology Owners and Operators When Selecting Digital Products.”
This document contains guidance for asset owners and operators on how to talk with a preferred automation supplier. The guidelines cover questions asset owners should be asking original equipment manufacturers (OEMs), as well as offer advice on what it means to be cybersecure at an operating facility.
The remarkable thing about this document is how many international agencies put their seals on it—38 agencies in total, including five from America (FBI, NSA, CISA, EPA, TSA). The Brits, Canuks, Kiwis, Aussies, and the entire European Commission (27 countries) contributed, as did BSI from Germany and the Netherlands. I challenge anybody to find a more accepted and endorsed cybersecurity document on the planet.
Since publication, the document has been downloaded countless times by operational technology (OT) professionals (the asset owners and operators), as well as by the OEM community, since it is obviously useful for OEM’s to know what advice their customers have been given.
Advice for automation suppliers
Although the CISA guidance was directed toward asset owners, we authors felt an obligation to share additional advice with the automation suppliers regarding what they might do to shore up their offerings for the OT buyer. This led us to provide one of the most helpful things we could offer the OEM community—the voice of the customer. As a group of neutral authors, we approached the asset owners with questions about their cybersecurity experiences. We compiled these into a second release, “Barriers to Secure OT Communication: Why Johnny Can’t Authenticate.” Published in February, this guidance[2] highlights the known issues with insecure-by-design legacy industrial protocols, and seeks to explain why the technology to secure these protocols is not widely adopted.
Our title intentionally echoes the 1999 landmark paper[3] entitled “Why Johnny Can’t Encrypt” by Alma Whiten and J.D. Tygar. That paper demonstrated how difficult it was for the average user to invoke sign-and-encrypt tools on something as simple as email using the tools of the day. How similar that felt to us, in an era where users are complaining about how difficult it is to apply cybersecurity features! So, you might forgive us for choosing a kitschy title and leveraging a logical license from previous publications.
“Why Johnny Can’t Authenticate, “ centers on recommendations for reducing identified cost and complexity issues that prevent the adoption of secure communication in OT facilities.
“Why Johnny Can’t Authenticate” includes voices from industries such as water/wastewater, transportation systems, chemicals, energy, food and agriculture. Summarizing the themes that were prevalent throughout the interviews, the document centers on recommendations for reducing identified cost and complexity issues that prevent adoption of secure communication in OT facilities. Although the target audience is the automation vendor community, it’s truly a great read for asset owners and facility operators as well.
What troubles asset owners?
To encourage you to download, read and use “Why Johnny Can’t Authenticate,” I’d like to draw your attention to a table from the document titled Secure Communications Operator Journey Map (Figure 1). In the last two columns of the “negative experiences” row, asset owners describe being troubled by interoperability issues and high complexity, and they also fear disruptions and sustained costs throughout their operations.
Asset owners describe being troubled by interoperability issues, high complexity, disruptions, and sustained costs,
but automation suppliers can address these issues. Source: OPC Foundation
The recommendations for manufacturers regarding how to address the concerns of asset owners are shown in the last row. The document deliberately refrains from mentioning any particular technologies, but it’s easy to conclude that OPC UA is the industry-acceptable methodology for addressing asset-owner concerns. Case in point: the OPC UA Global Discovery Service (GDS) centralizes certificate management and endpoint discovery across enterprise industrial networks. It also automates Public Key Infrastructure (PKI) administration through three core mechanisms:
• Automated Certificate Management: Requests, issues, renews, and revokes application instance certificates for clients and servers
• Trust List Synchronization: Automatically distributes trusted certificates to ensure secure node-to-node authentication without manual intervention
• Enterprise Directory Services: Maintains an updated registry of active OPC UA servers and endpoints to simplify complex OT network visibility.
As the industrial interoperability standard, OPC UA (IEC 62541) is embedded in almost every automation vendor’s products—just ask them. Their products include OPC UA Global Discovery Services in order to simplify key management, provide full and transparent interoperability between multi-vendor deployments, and invoke world-class cybersecurity measures with tremendous ease. It has always been a curious statement to hear automation vendors say, “Our customers never ask for things like that” when challenged on how completely they have embedded the latest OPC UA features.
With both documents—“Why Johnny Can’t Authenticate” and “Secure by Demand…”—in hand, asset owners are well equipped to ask for, and receive, full-fidelity OT cybersecure automation products. Asset owners have no excuse for deploying half-measures since ease of configuration and certificate management over the lifecycle of the facility is baked into the OPC UA cake.
No longer will owner/operators feel like they need a cybersecurity expert on staff to invoke perplexing, esoteric security measures that only they can crack. Instead, streamlined and easy-to-implement OPC UA deployments are bringing strong cybersecurity protection to the entire automation industry.
