What is OT security?
Operational technology (OT) is the hardware and software that monitors and controls physical things: valves, motors, conveyors, kilns, chillers, door locks, packaging lines. Industrial control systems (ICS) are the part of OT that runs a process: PLCs, HMIs, SCADA, distributed control systems and safety systems.
OT security is protecting those systems so the process keeps running safely. That last word matters. In IT, a bad day is lost or stolen data. In OT, a bad day can be a fire, a spill, a damaged machine or someone hurt.
IT vs OT: what changes
| IT | OT | |
|---|---|---|
| First priority | Confidentiality of data | Safety, then availability of the process |
| Typical lifetime | 3 to 5 years | 15 to 30 years |
| Patching | Monthly, automated | At planned shutdowns, after the vendor approves |
| Downtime | Annoying, scheduled at night | Lost production, sometimes unsafe |
| Protocols | HTTPS, SMB, DNS | Modbus, EtherNet/IP, PROFINET, S7, OPC UA, DNP3 |
| Who owns it | IT | Engineering, maintenance, the plant manager, often a vendor |
| Change control | Change board | Management of change (MOC), with safety review |
The protocols are the surprise for most IT people. Many industrial protocols have no authentication: anything that can reach a PLC on its port can often read and write it. That is why, in OT, who can reach what does more of the work than anything else.
IT/OT convergence
Plants used to keep control systems on their own isolated networks. Now the historian feeds the ERP, vendors support machines remotely, and engineering laptops move between the office and the floor. This IT/OT convergence is where most OT incidents start: not with an exotic PLC exploit, but with ordinary IT malware or a stolen remote access account that reaches a flat plant network.
The answer is not to undo convergence. It is to make every path between IT and OT deliberate, narrow and written down.
The Purdue model in two minutes
The Purdue model ranks systems by function, in levels:
- Level 0: the process: sensors, valves, drives.
- Level 1: basic control: PLCs and safety controllers.
- Level 2: area supervisory control: HMIs and local SCADA.
- Level 3: site operations: historian, MES, engineering workstations.
- Level 3.5: the industrial DMZ (IDMZ) between OT and IT.
- Levels 4 and 5: site business systems and enterprise IT.
Traffic should move one level at a time and never jump from enterprise IT straight to level 1. The free chapter Purdue model for OT security draws the levels and the zones for a small plant.
Purdue levels as bands, security zones as boxes, from Book 1's sample plant.
The core controls
Most OT security programs, and most OT security exams, come back to the same handful of controls:
- Asset inventory. You can't protect what you haven't listed. Record every controller, HMI, switch and server with its zone, owner and firmware. Passive discovery tools can find devices from network traffic without touching them; a source of truth such as NetBox keeps the list. See OT asset inventory in NetBox.
- Network segmentation. Group assets into zones and allow only written-down conversations between them. This is ISA/IEC 62443 zones and conduits.
- Secure remote access. Vendors and staff come in through a gateway in the IDMZ, with their own accounts, multi-factor authentication and sessions that are approved and logged. Never a port forward to an engineering workstation.
- Monitoring. Watch the conduits. OT monitoring tools read industrial protocols and flag a new device, a firmware download or a write to a PLC that nobody planned.
- Incident response that knows the plant. Pulling a network cable can stop a line or upset a process. Plan with operations who isolates what, and who decides.
- Backups of what can't be rebuilt. PLC programs, HMI projects and switch configurations, kept offline.
The frameworks you will hear about
- ISA/IEC 62443: the industrial standard series: zones, conduits, security levels, requirements for owners, integrators and suppliers. See the 62443 zones and conduits guide.
- NIST SP 800-82 Rev. 3: NIST's Guide to Operational Technology (OT) Security, free to download, with architecture guidance and an OT overlay of SP 800-53 controls. See NIST SP 800-82 and your network diagram.
- The NIST Cybersecurity Framework and sector rules such as NERC CIP for power, which you'll meet if you work in those sectors.
Where to start on Monday
Draw the network. Not the whole thing perfectly: the zones, the boundaries between them and every path from IT, the internet and vendors into the plant. Most teams find a path they didn't know about on the first afternoon. Then write those paths down as a flow register and check the firewall enforces it.
- Free: Purdue model network diagram (Book 1, Chapter 3).
- Free: score your network diagram in 20 questions.
- Studying for an OT security certification? The OT security study map maps exam topics to free guides and chapters.
- Manufacturing Network Diagrams, Book 1, is the full method for a plant, from blank page to an audit-ready drawing set.
