Why OT security is different from IT security
IT security is about protecting data. OT security is about protecting physical processes. The consequences of a compromised office PC are measured in data loss and downtime. The consequences of a compromised control system are measured in production loss, equipment damage, and in the worst cases, safety incidents.
OT systems also have different operational constraints. You cannot patch a PLC mid-production the way you patch a server. Control system software is validated against specific versions — an OS update that breaks a SCADA application is not an acceptable outcome. Downtime for security maintenance must fit within planned maintenance windows.
These differences mean IT security practices cannot be directly transplanted to OT environments. The principles are the same, but the implementation must account for the operational reality of industrial plant.
The flat network problem
The most common OT security vulnerability on older industrial sites is a flat network — all devices on the same network segment with no firewall or segmentation between them.
On a flat network, a threat that enters through any connected device can reach any other device. Corporate laptops that connect to the office network and then plug into the control system network. SCADA workstations with internet access for Windows updates. Vendor remote access connections with no audit trail. All of these are paths for threats to enter the OT environment.
Network segmentation — dividing the network into zones with controlled traffic flows between them — is the foundational OT security control. It does not prevent threats from entering, but it limits what a threat can reach once it is inside.
Zone and conduit architecture
The IEC 62443 standard defines an OT security architecture based on zones and conduits. A zone is a group of assets with similar security requirements and trust levels. A conduit is a controlled pathway for communication between zones.
A practical implementation for an industrial site typically includes:
Production zone - PLCs, SCADA clients, and engineering workstations. No direct connectivity from outside the zone. Devices in this zone should not have internet access.
DMZ (demilitarised zone) - Historian, data replication services, remote access infrastructure. Controlled access from both the production zone and the IT network via firewall policy. The DMZ is the buffer between production and IT.
IT network - Corporate IT infrastructure. No direct connectivity to the production zone. Data flows to and from the production zone via the DMZ only.
Remote access
Vendor and contractor remote access to OT systems is a common attack vector. Credentials are shared, sessions are not logged, and access is often broader than required.
Secure remote access to OT systems should:
- Require multi-factor authentication
- Log all sessions with user identification and timestamps
- Limit access to specific assets required for the task
- Allow access to be terminated immediately if required
- Not require inbound connections directly to production zone assets
A jump host or remote access gateway in the DMZ achieves these requirements. Vendors connect to the jump host, authenticate, and access only the systems they are authorised to reach. Sessions are logged. Access can be revoked without changing credentials on production systems.
Where to start
For sites with no existing OT security program, the first step is understanding the current state. An OT network assessment covers:
- Network topology and connected devices
- Traffic flows between zones
- Remote access paths
- Vulnerability scan of accessible systems
- Comparison against a baseline security framework
The assessment produces a prioritised finding list. Not everything needs to be fixed immediately — the findings are ranked by risk and remediation effort, and a practical roadmap developed from there.
Starting with network segmentation gives the most risk reduction for the effort. Once zones are established, other controls — patching programs, remote access improvements, endpoint protection — can be added progressively.