UK What OT security means
OT security is the protection of operational technology: the hardware and software that monitor and control physical equipment such as production lines, pumps, substations, conveyors and building plant. It covers programmable logic controllers, distributed control systems, HMIs, engineering workstations, industrial PCs, field devices and the industrial networks that connect them. The same discipline is also called OT cybersecurity, ICS security (for industrial control systems) or industrial cybersecurity.
The aim is the same as in IT security, keeping systems out of the wrong hands, but the consequences are physical. A compromised controller can stop a line, damage a machine, spoil a batch or put people at risk. That is why OT security starts from safety and uptime rather than from data. Our guide to the difference between IT and OT explains where one network ends and the other begins.
OT security used to rely on isolation. Plants ran closed networks and serial links that nobody outside could reach. Remote support, cloud analytics and plant-wide SCADA systems have joined those networks to the business side, so isolation alone is rarely realistic now.
Why OT security is different from IT security
Most IT security tools assume equipment can be patched, rebooted and replaced every few years. OT systems usually cannot, which changes how every control is applied.
-
//
Priorities run the other way. IT is usually ranked confidentiality, integrity, availability. OT puts safety and availability first, then integrity, with confidentiality last.
-
//
Long lifespans. Controllers and HMIs often run for 15–20 years, so many still use operating systems and firmware that no longer receive updates.
-
//
Patching needs a shutdown. Updates have to wait for a planned outage and are tested first, because an unexpected reboot stops production.
-
//
Protocols without authentication. Older industrial protocols such as Modbus were designed for closed networks and accept any command from any device that can reach them.
-
//
Scanning can cause faults. Active scans that are harmless on an office network can lock up older controllers, so OT teams prefer passive monitoring.
Common threats to OT systems
Most OT incidents do not start with malware written for a PLC. They start on the business network, or through a remote connection, and reach the plant because the two are not properly separated.
-
//
Ransomware from the IT side. In 2021 an IT ransomware attack led Colonial Pipeline to shut down its US fuel pipeline as a precaution, even though the control systems were not encrypted.
-
//
Targeted ICS malware. Stuxnet (2010), Industroyer (2016) and TRITON (2017), which went after safety instrumented systems, showed that attackers can write code for specific controllers.
-
//
Insecure remote access. Always-on vendor connections, shared passwords and remote desktop exposed to the internet are a frequent way in.
-
//
Removable media and laptops. USB drives and contractors’ laptops can carry malware past a network boundary.
-
//
Misconfiguration and flat networks. One large network with default passwords lets a single infected PC reach every controller on site.
OT security controls, layer by layer
Good OT security uses several layers, so one failure does not expose the process. The table shows the main controls and where the standards describe them.
| Control | What it does | Standard reference | Hardware involved |
|---|---|---|---|
| Asset inventory | Lists every device, firmware version and connection | IEC 62443-2-1, NIST SP 800-82 | Passive network monitoring sensors |
| Segmentation | Splits the network into zones joined by controlled conduits | IEC 62443-3-2 | Managed switches (VLANs, ACLs), firewalls |
| Access control | Authenticates people and devices before they connect | IEC 62443-3-3, IEEE 802.1X | Switches with 802.1X and RADIUS |
| Device integrity | Stops modified firmware or software from running | IEC 62443-4-2 | TPM 2.0, UEFI Secure Boot |
| Secure remote access | Brokers vendor sessions through one monitored point | IEC 62443-3-3, NCSC CAF | Jump hosts in an industrial DMZ |
| Monitoring and recovery | Detects unusual traffic and restores known-good images | NIST SP 800-82, NCSC CAF | Port mirroring, backups, spare systems |
Hardware controls only help when they are switched on and kept up to date, so they sit alongside policy, training and an incident response plan.
Standards and regulation for OT security
The IEC 62443 series, developed with the ISA99 committee, is the main international framework. It covers the asset owner’s security programme, risk assessment with zones and conduits, system requirements and the secure development of components. In the US, NIST SP 800-82 Revision 3 (2023), the Guide to Operational Technology Security, gives similar guidance and CISA publishes advisories for industrial control systems.
In the UK, operators of essential services in energy, water, transport and health fall under the NIS Regulations 2018 and are typically assessed against the NCSC Cyber Assessment Framework (CAF). In the EU, the NIS2 Directive widens the sectors covered, ENISA publishes guidance, and the Cyber Resilience Act adds security requirements for connected products themselves. Check the current status of each regime for your sector, because they are still being updated.
The hardware side of OT security
Software and procedures do most of the work, but the hardware chosen for a site decides which controls are available at all.
-
//
Switches that can segment. Our managed industrial switches almost all list IEEE 802.1Q VLANs, and most list IEEE 802.1X port authentication, with RADIUS, TACACS+ or access control lists on many models.
-
//
A hardware root of trust. A Trusted Platform Module stores keys and boot measurements in hardware. TPM 2.0 is listed on many of our DIN rail PCs and on a number of gateways.
-
//
Separate network controllers. Industrial IoT gateways with two or more Ethernet controllers can collect data on the plant side and pass selected values upward without bridging the networks.
-
//
Long availability. Hardware that stays available for years can be patched and replaced like for like, without a redesign each time.
Quick answers on OT security
OT security: common questions
What does OT stand for in cyber security?
Operational technology. It means the systems that control physical processes, as opposed to IT, which handles business data. OT security protects controllers, HMIs, SCADA servers and the industrial networks between them.
What is the difference between IT and OT security?
The priorities and the constraints. IT security protects data first and can patch quickly. OT security protects safety and uptime first, and works around equipment that may run unchanged for 15 years or more.
What are the best practices for OT security?
Know, separate, control and recover. Keep an asset inventory, segment the network into zones, control remote access, harden devices, monitor traffic and hold tested backups of every controller and PC.
What are the main OT security standards?
IEC 62443 first. NIST SP 800-82 is widely used in the US and the NCSC CAF in the UK. Sector rules such as the NIS Regulations, NIS2 and NERC CIP for North American power apply on top.
Is OT security the same as ICS security?
Nearly. ICS security focuses on industrial control systems such as SCADA, DCS and PLCs. OT security is the wider term and also covers building management, transport and other operational systems.
We supply industrial PCs, gateways and managed switches with the security features each model supports, such as TPM, Secure Boot, VLANs and port authentication, enabled and configured as standard, so the hardware fits the zones and access policies your security team defines.