Legacy SCADA systems in the oil and gas industry face significant cybersecurity challenges due to aging infrastructure, increasing IT/OT convergence, and evolving threat landscapes. These systems, often designed before cybersecurity was a primary concern, lack modern security features while controlling critical infrastructure components essential for national energy security. The combination of outdated operating systems, proprietary hardware with limited update capabilities, and protocols without authentication or encryption creates substantial vulnerabilities. Complete system replacement is typically impractical due to prohibitive costs and operational disruption risks. This article addresses practical, cost-effective security strategies that can be implemented while maintaining operational integrity. By examining network segmentation, industrial protocol-aware intrusion detection, application whitelisting, host hardening, and unidirectional security gateways, the article presents proven defensive measures specifically tailored for legacy SCADA environments. These approaches acknowledge the operational constraints of industrial control systems while providing meaningful security improvements that significantly reduce exposure to modern cyber threats without requiring wholesale replacement of existing systems.