What is a rogue device?
A rogue device is an unauthorised or unknown device that connects to a network without approval, registration or proper configuration. It can be a deliberately planted attack device, but far more often it is an unintentionally connected laptop, sensor, switch, 4G router or wireless access point belonging to a colleague or supplier. What makes a device “rogue” is not the hardware itself, but the fact that it sits outside the asset inventory and outside asset management.
In OT networks, rogue devices pose a serious risk, because they can directly affect the reliability, availability and safety of industrial systems.
🧠 What types of rogue devices occur in OT?
Rogue devices fall roughly into three groups: those connected by accident, those connected for convenience and those connected with malicious intent. In plants and installations you mostly encounter the first two.
| Device | How does it get on the network? | Risk |
|---|---|---|
| Unauthorised laptop | A service engineer or in-house engineer plugs into a free port | Malware infection, ARP spoofing, network scans |
| Unmanaged switch | Extra ports needed in a control cabinet | Several devices behind one port, no visibility, no port security |
| Misconfigured sensor | Replacement field device with the wrong IP address or factory defaults | Disrupted measurements, faulty process actions, IP conflicts |
| Personal Wi-Fi router or rogue access point | Working wirelessly on the shop floor | Open back door, bypassing network segmentation |
| Supplier’s 4G/5G router | Quick remote maintenance outside IT policy | Direct internet connection next to the firewall |
| Dev board (e.g. Raspberry Pi) or network implant | Test set-up, or deliberately planted by an attacker | Covert packet capture or a bridge to the internet |
| Dual-homed device | PC with a second network card or a USB network adapter | Bridges the IT and OT zones |
🔐 Why are rogue devices especially dangerous in OT?
- No asset management - they are not recognised by Asset Inventory systems, so nobody knows they exist or who is responsible for them.
- No policies - no updates, no logging, no access limits and often default passwords.
- Possible malware - an infected laptop can spread Malware or eavesdrop unnoticed.
- Bypassing security - they can connect networks or zones without control and so undermine the zones and conduits model.
- Added unintentionally - for instance by suppliers or maintenance contractors who bring their own tools.
OT adds a further problem. Many industrial protocols, such as Modbus TCP and ProfiNET, have no authentication. A device on the right segment can therefore send write commands to a PLC as if it were a legitimate engineering workstation. On top of that, OT networks are often flat and installations stay in service for twenty years or more, so a forgotten device can go unnoticed for years.
A well-known example from the IT world shows how it goes wrong. At NASA’s Jet Propulsion Laboratory, staff discovered in April 2018 that attackers had got in through a Raspberry Pi connected to the network without authorisation. They had moved through the network undetected for about ten months and removed roughly 500 MB of data from 23 files. NASA’s inspector general reported in June 2019 that the lab’s inventory was incomplete, so administrators did not know the device was there.
🔍 How do you detect rogue devices?
Detection starts with a reliable reference: an up-to-date list of the devices that are allowed to be there. Every deviation from that list is a candidate rogue device.
| Method | Explanation | Suitable for OT? |
|---|---|---|
| Passive monitoring via SPAN or TAP | Listen to traffic and flag new MAC or IP addresses | Yes, adds no traffic to the network |
| OT IDS (e.g. Nozomi, Claroty, Dragos) | Identify assets automatically and alert on new devices or anomalous behaviour | Yes, built for OT protocols and adds no network traffic |
| Asset Discovery with active scans | Probe the network and compare with known devices | Only with care and in maintenance windows |
| SNMP monitoring of switches | Switches report active MAC addresses per port | Yes, on managed switches |
| DHCP logging and DHCP Snooping | Make new leases and unknown DHCP servers visible | Limited, OT often uses static IP addresses |
| Wireless survey | Scan for unknown access points and hotspots | Yes, periodically and during audits |
| Physical inspection | Walk past control cabinets and patch panels | Yes, also finds devices that do not communicate |
Active scanning calls for restraint in OT. Older PLCs and field devices can hang on unexpected packets, so a scan can itself cause an outage. Passive methods are therefore the default, and active querying is used only in a targeted way with the consent of the person responsible for the process.
🛡️ How do you stop a rogue device from gaining access?
| Measure | Effect | Caveat |
|---|---|---|
| 802.1X authentication with RADIUS | Access only after device or user verification | Many OT devices do not support 802.1X; MAC Authentication Bypass is then the fallback |
| NAC (Network Access Control) | Assesses devices before granting access and quarantines unknown ones | Introduce it in monitor mode first to avoid production outages |
| Port Security and MAC Binding | Only known MAC addresses per switch port | MAC addresses are easy to spoof; this is a first barrier only |
| Disabling unused ports | No free connection points in cabinets or on the floor | Cheap and effective |
| Segmentation via VLAN | Isolate new or unknown devices in a quarantine VLAN | Combine with firewall rules between zones |
| DHCP Snooping and Dynamic ARP Inspection | Blocks rogue DHCP servers and ARP spoofing | Requires managed switches |
| Physical access control | Prevents unauthorised access to control cabinets or ports | Locks, seals and port blockers |
| Supplier agreements | Rules for maintenance contractors on what they may and may not connect | Offer managed remote access as an alternative |
A Zero Trust Architecture also limits the impact of a rogue device that does get in, because no device is trusted on the basis of its network location.
📏 What do standards and legislation say about rogue devices?
| Framework | Relevant requirement |
|---|---|
| IEC 62443-3-3 | SR 1.2 (device identification and authentication), SR 7.7 (least functionality, such as disabled ports) and SR 7.8 (control system component inventory) |
| CIS Controls v8 | Control 1 (inventory of assets); safeguard 1.2 requires unauthorised assets to be removed, denied or quarantined at least weekly |
| NIST SP 800-82 Rev. 3 (2023) | Asset inventory, network access control and monitoring as the basis of OT security |
| CISA asset inventory guide (August 2025) | Joint OT guidance co-authored by the Dutch NCSC; every addition or removal of a device goes through change management, even under emergency change |
| NIS2 / Dutch Cybersecurity Act | Asset management is a mandatory measure within the duty of care; the Dutch Cybersecurity Act (Cyberbeveiligingswet) has applied since 15 August 2026 |
🧭 How do you tackle rogue devices step by step?
- Establish a baseline - combine a physical walk-down of cabinets and patch panels with several weeks of passive monitoring, so that devices that rarely communicate also show up.
- Record the approved state - register at least the MAC address, IP address, manufacturer, model, location, role and owner of every device.
- Close the doors - disable unused switch ports and enable port security. On Cisco switches the default maximum is one MAC address per port and the default action is shutdown. In OT many administrators choose restrict instead: unknown traffic is blocked and reported, but the port stays up for the legitimate device.
- Alert on new devices - have the OT IDS or the switches send an event to the SIEM as soon as an unknown MAC address appears.
- Assess every alert - decide whether it is a replaced field device, a supplier or a genuine intrusion, and update the inventory through change management.
- Repeat periodically - CIS Controls v8 sets weekly handling as the minimum; physical inspections and wireless surveys fit well into the annual audit.
❓ Frequently asked questions
What is the difference between a rogue device and an unknown device?
An unknown device is any device that is not in the inventory. It becomes a rogue device once it turns out to have been connected without approval. In practice some unknown devices prove legitimate, such as a replacement sensor that has not yet been registered.
Is an unmanaged switch always a rogue device?
An unmanaged switch is not a rogue device by definition, but it becomes one when it is placed in a control cabinet without approval. Even an approved unmanaged switch is a risk, because it offers no port security, logging or SNMP monitoring. Replace it with a managed industrial switch where possible.
Can you stop rogue devices with MAC filtering?
MAC filtering and port security stop unintentionally connected devices well. An attacker, however, can easily copy the MAC address of an approved device. Combine MAC filtering with 802.1X where possible, and with monitoring for anomalous behaviour.
Why is 802.1X rarely used in OT?
Many PLCs, sensors and older HMIs have no 802.1X client, so they cannot authenticate themselves. Administrators also fear that a RADIUS server outage could stop production. OT therefore often uses MAC Authentication Bypass, or limits 802.1X to engineering workstations and laptops.
How often should you check for rogue devices?
Continuous passive monitoring with an OT IDS gives the best coverage, because a new device then becomes visible within minutes. CIS Controls v8 requires unauthorised devices to be handled at least weekly. Physical inspections and wireless scans complement this periodically.
Is detecting rogue devices mandatory under NIS2?
NIS2 and the Dutch Cybersecurity Act do not mention rogue devices by name, but they do require essential and important entities to take appropriate measures for asset management and access control, among others. An up-to-date inventory with detection of unauthorised devices is a logical way to meet that. The Dutch act has applied since 15 August 2026.
📌 In summary
Rogue devices are invisible intruders in OT networks, placed deliberately or accidentally, that endanger the reliability and safety of industrial processes.
It is essential to maintain visibility of all connected devices and to restrict network access by default to known, authenticated components. Start with an up-to-date inventory, detect passively, close unused ports and agree with suppliers on how they can connect safely.