Firmware Update Management for Industrial Devices: Policy Over Panic
Firmware updates are the hardest maintenance task in OT: they fix security holes and bugs, yet a failed update can take a machine down for hours. The answer is not "update everything immediately" or "never touch anything" - it is a managed process with testing and rollback.
The Process
- Inventory: extend the asset inventory with current firmware versions per device.
- Monitor vendor releases: subscribe to security advisories for your controllers, drives, switches, and gateways. Not every release is urgent; most are bug fixes you can batch.
- Risk-rate: security fixes for internet-facing or remotely accessible devices are high priority; cosmetic feature releases are low. Availability impact of the update is part of the risk.
- Test before floor: validate the exact firmware on a lab or spare unit with the same hardware revision - same model is not enough; revisions differ.
- Schedule with operations: updates are change management, with a window, a rollback plan, and a sign-off.
Rollback Is the Plan
Before updating, archive the current firmware file and configuration. Many controllers support downgrade, but some do not - check the release notes. If rollback is impossible, the test step is not optional; it is the entire safety net.
Vendor Pressure
Vendors will push urgent updates for their own reasons. Evaluate the advisory against your actual exposure: a device that is fully segmented and has no remote access may not need an immediate update, and a documented, risk-assessed decision is a legitimate outcome.