Securing the Brownfield: A Retrofit-First Framework for OT Cybersecurity in Legacy Process Plants

Abstract

This review examines cybersecurity modernization in legacy process plants through a retrofit-first perspective that prioritizes risk reduction without assuming wholesale replacement of operational technology. It synthesizes literature on industrial control systems, supervisory control and data acquisition environments, legacy architectures, industrial protocols, asset visibility, segmentation, access control, monitoring, patch governance, standards alignment, workforce capability, vendor dependence, and cyber resilience. The analysis adopts a structured narrative review approach, integrating international scholarship with selected African and Nigerian evidence to evaluate both technical and organizational constraints affecting brownfield environments.
The findings show that legacy plants remain exposed because aging devices, insecure protocols, unsupported software, weak trust boundaries, remote connectivity, and heterogeneous architectures coexist with stringent requirements for safety, availability, deterministic performance, and long asset lifecycles. Effective modernization therefore depends on staged interventions built around asset discovery, risk prioritization, zoning, network segmentation, least-privilege access, compensating safeguards, passive monitoring, anomaly detection, disciplined incident response, and risk-informed patching. The review further demonstrates that security assurance requires alignment with recognized industrial standards, measurable maturity, cross-functional governance, workforce development, and stronger supplier accountability.
The study concludes that brownfield cybersecurity is fundamentally a resilience and lifecycle-management challenge rather than a conventional replacement exercise. Retrofit strategies are most defensible when they reduce exposure while preserving process continuity and engineering integrity. Future practice should emphasize evidence-based control selection, validated maintenance windows, scalable monitoring, digital-twin-assisted testing, and adaptive analytics. Future research should prioritize multi-site empirical studies, realistic datasets, lifecycle cost analysis, and measurable resilience outcomes that demonstrate sustained security improvement across heterogeneous legacy plants. These priorities can support safer, more proportionate modernization across critical industrial environments.