OT and ICS security

Operational technology is the hardware and software that monitors and controls physical processes: the pumps, valves, turbines, breakers and production lines that make electricity, move water, refine fuel and build things. It runs on devices most office workers never see. A programmable logic controller (PLC) reads a sensor and drives an actuator on a fixed cycle measured in milliseconds. A supervisory control and data acquisition (SCADA) system gathers those readings across a plant or a region so an operator can watch and command the process from one screen.

The reason IT instincts mislead in this world is that the worst outcome changes. In a bank, the nightmare is a data breach: confidentiality lost. On a pipeline or a substation, the nightmare is a burst main, a fire, a blackout or an injured worker: safety and availability lost. So the familiar order of confidentiality, integrity and availability turns over. Availability and safety come first, then integrity of the control signal, and confidentiality last. An engineer who locks a control network so tightly that an operator cannot reach an alarm has not made the plant safer; they have created a new way for it to fail.

This inversion is not the only difference. IT assets are replaced every three to five years and patched within days of a fix. OT assets run for ten to twenty years, are patched only inside scheduled outage windows agreed months ahead, and often cannot be rebooted on demand because rebooting means stopping production. The free, government-backed reference for all of this is NIST SP 800-82r3, the Guide to Operational Technology Security, published in September 2023. It is the document to hand a colleague who still thinks OT is just IT in a hard hat.

The Purdue model is the shared map of an industrial network. It arranges systems into levels by how close they sit to the physical process. Level 0 is the process itself: sensors and actuators. Level 1 is basic control: the PLCs and safety controllers that act on those sensors. Level 2 is supervisory control: the human-machine interfaces and alarm servers an operator works from. Level 3 is site operations: the SCADA servers, historians and engineering workstations that run the plant day to day. Levels 4 and 5 are the business and enterprise systems, the ordinary IT of scheduling, email and the wider corporation.

Read from the bottom, the model is a statement about blast radius. The closer a system sits to Level 0, the more directly a fault there becomes a physical event, so the more carefully traffic reaching it must be controlled. The whole point of the layering is that nothing at Level 5 should be able to speak straight to a Level 1 controller.

The honest problem is that the clean levels blur in practice. A modern plant streams telemetry to a cloud analytics service. Vendors expect remote access to maintain the equipment they sold. Industrial internet-of-things sensors arrive with their own network stacks. Each of these is a good operational reason to punch a hole between the levels, and each hole is a path an attacker can walk. This is why the popular claim that industrial systems are safe because they are air-gapped is, for most real plants, no longer true. The gap rarely survives contact with the demands of running the business.

The move a mature operator makes is to stop arguing about whether a gap exists and start governing the crossings that undeniably do. That is the subject of the next section, and it is the design idea the figure below sets out: the levels held inside two zones, split by a controlled boundary, with each crossing named.

The international standard for securing industrial automation is the ISA/IEC 62443 series. Its central design idea is deceptively plain. Group assets that share the same security needs into a zone, and allow those zones to communicate only through a conduit: a defined, controlled channel that is the sole permitted crossing. An industrial demilitarised zone sits between the enterprise zone and the control zone, so that a patch server or a data broker can do its job without the two sides ever talking directly. Draw the zones, draw the conduits, and any connection you have not drawn is by definition one that should not exist. That is the test the knowledge check below asks you to apply.

62443 measures how strong a zone needs to be with a security level, graded SL1 to SL4. SL1 resists casual or accidental misuse; SL4 resists a well-resourced attacker who is specifically targeting that system with deep knowledge of it. You set a target level per zone based on what a failure there would cost, then choose controls that meet it, rather than buying one expensive control and hoping it helps everywhere. Underneath the levels sit the standard's seven foundational requirements, which name the capabilities every design has to address: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.

62443 also does something most security standards skip: it splits responsibility between three named roles, and each has its own parts of the standard. The asset owner runs the plant and owns the risk. The system integrator designs and builds the secured system from components. The product supplier makes the PLC or the software to a secure development standard. The 62443-2-1 part, which sets out the security programme an asset owner must run, was reissued in 2024, so a supplier who quotes the older edition is telling you how current they are. For the attacker's view of this world, the ATT&CK for ICS knowledge base catalogues the specific techniques seen against control systems, from manipulating a controller to inhibiting a safety function, which lets a defender check their zones against real tradecraft rather than against imagination.

In Great Britain this is not only good practice; for energy it is law. Under the Network and Information Systems Regulations 2018, an energy company that meets the thresholds is an operator of essential services and must take appropriate security measures and report significant incidents. For the GB energy sector the competent authority that enforces this is Ofgem, working with the Department for Energy Security and Net Zero. Ofgem does not assess operators against a tick-box checklist. It uses a profile adapted from the National Cyber Security Centre's Cyber Assessment Framework, with the weighting shifted towards the operational-technology outcomes that matter most when the asset in question is a substation rather than a spreadsheet.

The stakes are rising because the sector is adding digital surface every quarter. The National Energy System Operator took over Great Britain's system operation in October 2024. The Review of Electricity Market Arrangements concluded in July 2025, with its delivery plan running from April 2026. The move to market-wide half-hourly settlement is migrating towards its May 2027 milestone. Each of these programmes connects more devices, more data flows and more parties to systems that used to be closed. A regulator that once worried about a handful of control rooms now has to reason about a grid of smart meters, distributed generation and market platforms, all of which widen the ground an attacker can stand on.

Turning the zone diagram into a real boundary rests on a small number of concrete mechanisms. A jump host, sitting in the demilitarised zone, is the single monitored machine through which any human administrator must pass to reach the control side, so that remote access is a controlled event rather than a standing door. A protocol break terminates the enterprise-side connection and starts a fresh one into the control zone, so no packet flows end to end and a payload cannot simply ride through. Where data need only move in one direction, out of the plant to a historian or a dashboard, a unidirectional gateway enforces that physically: it can send but is built so nothing can come back the other way. Together these are ordinary defence in depth applied to a boundary that carries physical consequences.

The harder problem is often not technical but organisational: who owns patching a fifteen-year-old PLC that the maker no longer supports and that cannot be taken offline without stopping production. The IT team says it is not their device; the engineering team says security is not their trade; the vendor says the contract ended years ago. Nobody is wrong, and so nobody acts. Naming that owner, and giving them the outage windows and the compensating controls to act within, is as much a part of OT security as any gateway. This is also where a zero trust posture meets its limits: you cannot simply demand that a decades-old controller authenticate every request when it was never built to, so you protect it by controlling everything that can reach it. The practical work of this module is exactly that, and the workspace tool for it lets you place your own assets on the levels and defend the conduits you draw.