OT security, also called operational technology security or OT cyber security, protects the systems that keep a factory, a power plant or a water utility running. Operational technology (OT) includes programmable logic controllers, distributed control systems, supervisory control and data acquisition (SCADA), HMIs, robots, drives and safety systems. When these systems are attacked, the damage is not limited to data: production stops, products are scrapped, equipment breaks and people can be hurt.
- Protects: industrial control systems, PLCs, SCADA, DCS, sensors and actuators
- Top priorities: availability and safety, then integrity and confidentiality
- Key standard: IEC 62443 for the security of industrial automation and control systems
- Regulation: NIS2 for operators, Cyber Resilience Act for product manufacturers
What is OT in cybersecurity?
In cybersecurity, OT stands for operational technology, the counterpart to information technology (IT). IT systems process information: email, ERP, office applications. OT systems interact with the physical world: they read sensors, move motors, open valves and control processes. OT security covers the people, processes and technologies that protect each OT system, the OT devices and the OT network they run on, including remote terminal units in distributed infrastructure.
For decades, OT environments were isolated, used proprietary protocols and were considered safe by obscurity. Industry 4.0 changed that. Machines now connect to MES, ERP, cloud platforms and remote service, which brings efficiency, but also exposes OT assets to the same cyber threats as IT.
What is the difference between IT and OT cybersecurity?
| IT security | OT security | |
|---|---|---|
| Main priority | Confidentiality of data | Availability and safety of the process |
| System lifetime | 3 to 5 years | Often 15 to 30 years |
| Patching | Regular, often automatic | Only in maintenance windows, after testing |
| Protocols | Standard IT protocols with security | Many legacy industrial protocols without authentication |
| Impact of an incident | Data loss, downtime | Production stop, damage, safety risks |
These differences mean that traditional IT security tools cannot simply be copied into an OT environment, and an effective OT security program needs its own security strategies. An aggressive network scan that is harmless in IT can crash an old controller. Security measures have to respect real-time requirements and long lifecycles.
Why is OT cybersecurity important?
Attacks on industrial control systems are documented since Stuxnet in 2010, followed by the attacks on the Ukrainian power grid in 2015 and 2016 and the Triton malware that targeted safety systems in 2017. Today the most common threat is ransomware that spreads from the IT network into production, forcing companies to shut down plants as a precaution. Each of these high-profile OT cyberattacks shows that OT security is a business continuity topic, not only a technical one. The convergence of IT and OT increases the risk of cyber incidents disrupting production, which is why agencies such as the US Cybersecurity and Infrastructure Security Agency (CISA) and the German BSI publish specific guidance for industrial security.
Main threats to OT systems
- ransomware and malware entering from the IT network
- insecure remote access for maintenance and service
- legacy systems with known security vulnerabilities that cannot be patched quickly, often a whole industrial control system running on outdated software
- flat networks without segmentation between IT, OT and safety systems
- supply chain risks from components, software and integrators
- missing asset inventory, so nobody knows what is connected
IEC 62443 and the Purdue model
IEC 62443 is the international cybersecurity framework for the security of industrial automation and control systems. It defines roles (asset owner, system integrator, product supplier), requirements for each role and security levels from 1 to 4. A central concept is zones and conduits: the network is divided into zones with similar security needs, and communication between them runs through controlled conduits. The Purdue model, which divides an industrial network into levels from field devices to enterprise IT, is often used to plan this segmentation and the OT network architecture. In the US, NIST SP 800–82 provides comparable guidance.
Best practices for protecting OT systems
No single security solution covers everything. These security best practices form the core of OT cybersecurity:
- Know your OT assets: asset management is the first best practice. Build and maintain an inventory of devices, firmware and connections, so you can manage OT risks you actually know about.
- Segment the network: separate IT and OT, and create zones within OT.
- Secure remote access: central, authenticated, logged access instead of individual modems or VPNs.
- Manage vulnerabilities: track vulnerabilities in all components, for example with SBOMs, and patch in planned windows.
- Monitor the OT network: OT security monitoring and OT threat detection analyze network traffic and detect anomalies with OT-aware tools.
- Apply security controls: access control, multi-factor authentication for remote users and hardened configurations reduce the attack surface.
- Prepare for incidents: backups of controller programs, recovery plans and exercises.
- Demand security from suppliers: secure-by-design products, update commitments and security documentation.
OT security, regulation and open standards
Two EU laws make OT cybersecurity mandatory. The NIS2 Directive requires operators in critical sectors, including many manufacturers, to manage cybersecurity risks in their OT environment. The Cyber Resilience Act requires manufacturers of controllers, sensors, machines and industrial software to deliver secure products with security updates.
Open standards help here. OPC UA brings authentication and encryption to industrial communication. The OI4 Industrial Cyber Security workgroup defines security requirements for every layer of the OI4 architectural guardrails, and its white papers on vulnerability management with SBOMs, post-quantum cryptography and Asset Administration Shell security are available in the OI4 downloads.
Frequently asked questions
What does OT stand for in OT security?
OT stands for operational technology: the hardware and software that monitors and controls physical devices and processes in industry, such as PLCs, SCADA systems and industrial robots.
What is the difference between OT security and ICS security?
The terms are often used interchangeably. ICS security focuses on industrial control systems, while OT security is slightly broader and covers all operational technology, including building automation and other cyber-physical systems.
Where should a company start with OT cybersecurity?
With visibility. An inventory of OT assets and their connections is the basis for every further step, from segmentation to vulnerability management.