OT Cybersecurity Best Practices for SMBs: Managing Default Passwords and Identifying ICS/OT Devices Exposed to the Internet

**Executive summary:** Dragos OT-CERT publishes pragmatic OT/ICS cybersecurity best practices for under-resourced organizations, focusing on two persistent risks — devices exposed to the internet and unchanged default or hardcoded passwords — and provides concrete steps to identify, remediate, and defend those exposures (asset discovery, public IP scanning, firewalls/VPNs, configuration hardening, patching, compensating controls) while inviting organizations to join OT-CERT for free resources and guidance.