What Is OT/ICS Security?

Why OT Security Differs from IT Security

OT systems are designed for reliability and availability rather than security. Industrial controllers that manage chemical processes, electrical generation, water treatment, or manufacturing lines are often 15-30 years old, running operating systems no longer receiving security updates, communicating on protocols designed before network security was a consideration, and cannot be patched or rebooted without operational disruption. The standard IT security approach — deploy patches promptly, implement endpoint security agents, segment systems aggressively — frequently cannot be applied to OT without risking operational failure.

The convergence of IT and OT networks — driven by industrial IoT, remote monitoring, and the business value of operational data — has created pathways between corporate IT networks and OT environments that did not previously exist. Attackers who breach the corporate IT environment now have potential pathways to OT systems that were historically air-gapped.

OT Attack Consequences

OT security incidents have consequences beyond data theft or financial loss. The 2021 Oldsmar, Florida water treatment facility attack involved an attacker briefly increasing sodium hydroxide concentration in the water supply to dangerous levels through a remotely accessible control system. The 2022 Ukrainian power grid attacks caused widespread power outages through malware that disabled grid management systems. Triton/TRISIS, deployed against a Saudi Arabian petrochemical facility, specifically targeted Safety Instrumented Systems designed to protect workers from industrial accidents.

Volt Typhoon and Critical Infrastructure Targeting

The most significant recent development in OT security is the sustained targeting of US critical infrastructure by Chinese state-sponsored group Volt Typhoon, disclosed publicly by CISA and NSA in May 2023 and confirmed in subsequent advisories. Volt Typhoon operators were found to have maintained persistent access to US critical infrastructure networks — water utilities, energy systems, transportation infrastructure — for periods of five years or more, specifically pre-positioning for disruptive attacks in the event of military conflict with Taiwan.

Volt Typhoon operated entirely through living-off-the-land techniques using legitimate tools present in the environment, making detection extremely difficult. The campaign's discovery came through sustained threat hunting by government and private sector analysts rather than automated detection. The scale and duration of the campaign — affecting hundreds of organizations across all critical infrastructure sectors — represents the most serious known OT security threat to US infrastructure.

OT Security Assessment Priorities

For PE sponsors with portfolio companies that include manufacturing, energy, utilities, or other industrial operations, OT security assessment should evaluate: Is there network segmentation between IT and OT environments, and has it been validated rather than just documented? Are remote access pathways to OT systems controlled and monitored? Are OT systems inventoried, including legacy systems with known unmitigatable vulnerabilities? Is there monitoring capability for OT network traffic that would detect anomalous communication patterns? Is there an OT-specific incident response plan that accounts for the safety implications of OT system disruption?

Related Reading

• What is DNS Security?
• What is IoT Security?

What is OT/ICS security?

Operational Technology and Industrial Control System security is the protection of the computing systems that monitor and control physical processes in manufacturing, utilities, energy, transportation, and similar industries. Unlike IT systems where confidentiality and integrity are paramount, OT systems prioritize safety and availability because compromise can cause physical damage, injury, or loss of life. The discipline has its own standards, threat actors, and architectural patterns distinct from IT security.

How is OT security different from IT security?

OT systems often run for decades on hardware and software that cannot be patched. Availability is paramount because downtime stops production or services. Safety is the primary concern since OT controls physical processes that can injure people. Legacy protocols like Modbus, DNP3, and Profinet lack authentication and encryption. Vendor support windows extend far longer than IT. The Purdue Model defines layered architecture different from typical IT network segmentation.

Who are the threat actors targeting OT environments?

Nation-state actors including Russia's Sandworm and Iran's CyberAv3ngers specifically target OT for strategic effect. Ransomware groups like LockBit and BlackCat increasingly target OT environments knowing operational disruption forces ransom payment. Hacktivists target utilities and critical infrastructure for media attention. Insider threats are particularly dangerous in OT given the physical access many roles require. The Volt Typhoon campaign disclosed by CISA in 2023 highlighted nation-state pre-positioning in US critical infrastructure.

What standards govern OT security?

IEC 62443 is the international standard for industrial automation and control systems security. NIST SP 800-82 provides US federal guidance. NERC CIP applies to North American electric utilities. TSA Security Directives now cover pipeline operators following Colonial Pipeline. CISA's CPGs target critical infrastructure baseline. CMMC affects defense industrial base manufacturers. Most OT operators follow a combination of standards driven by industry, jurisdiction, and customer requirements.

What tools and platforms address OT security?

OT visibility platforms including Claroty, Dragos, Nozomi Networks, and Armis specialize in passive discovery and threat detection for industrial environments. Microsoft Defender for IoT addresses the cloud-managed segment. Network segmentation tools enforce Purdue Model boundaries. ICS-aware firewalls from vendors like Tofino and Hirschmann understand industrial protocols. Industrial DMZ designs control traffic between IT and OT zones using data diodes and unidirectional gateways for high-assurance environments.

How do organizations build an OT security program?

Programs start with passive asset discovery to build an inventory without disrupting operations. Network architecture is reviewed against the Purdue Model and segmentation gaps closed. Remote access is restricted to authenticated, monitored pathways including jump hosts and ZTNA. Detection is deployed at OT-IT boundaries and within OT zones. Incident response procedures address the safety and operational implications of OT incidents. Tabletop exercises practice cross-functional response with operations and engineering.

What is the first step in OT security?

Conduct passive asset discovery to inventory what is actually on the OT network. Most operators find significantly more devices than expected, undocumented IT-OT connections, and remote access paths nobody knew existed. The inventory becomes the foundation for segmentation, monitoring, and remediation prioritization. Do not attempt active scanning of OT networks; passive discovery is the standard approach for a reason.

Real-World Example: Colonial Pipeline — IT Breach, OT Shutdown

The May 2021 Colonial Pipeline ransomware attack is the most consequential OT security incident in US civilian infrastructure history. The DarkSide ransomware encrypted Colonial Pipeline's IT billing and business systems — not OT systems. Colonial Pipeline proactively shut down the OT pipeline control system as a precaution because they could not confirm the breach had not spread to OT. The result: 5,500 miles of pipeline delivering 45% of East Coast fuel supply halted for six days, causing gas shortages across the southeastern United States. The IT breach caused OT disruption through the operational decision to shut down, not through direct OT compromise.