OT / ICS Security Training

Operational Technology (OT) is the hardware and software that monitors and controls physical processes — power generation, water treatment, oil refining, manufacturing assembly lines, railway signalling, and hospital life support systems. Unlike IT systems that process information, OT systems control the physical world. This distinction changes every security calculation you have ever learned.

In IT security, the priority order is CIA: Confidentiality, Integrity, Availability. A database breach that exposes data is serious. In OT security, the priority order is AIC: Availability first. A power plant control system that stops working may kill people — either immediately (a hospital loses power) or through cascading failures (a refinery shuts down causing an explosion). A cybersecurity patch that requires a 4-hour downtime of a nuclear plant coolant system may be more dangerous than the vulnerability it fixes.

The Purdue Model (also called ISA-95 or the Industrial Automation Hierarchy) divides an industrial facility into network zones from the physical process at the bottom to the corporate network at the top. Security controls are applied at the boundaries between zones — the more critical the zone, the more isolated it should be.

The security principle of the Purdue Model is zone and conduit: each level is a security zone, and communication between zones only occurs through controlled conduits (firewalls, data diodes, jump servers). In practice, many industrial facilities have collapsed these zones over decades of connecting systems for convenience, creating direct paths from Level 4 to Level 1 with no security controls between them.

You cannot defend what you do not understand. Before you can assess whether a PLC is misconfigured or compromised, you need to know what a PLC does normally, how it communicates, what legitimate traffic looks like, and what unusual behaviour looks like. This module breaks down every major OT component and how attackers target each one.

A PLC (Programmable Logic Controller) is a ruggedised industrial computer that reads inputs from sensors and writes outputs to actuators based on a user-programmed logic. A water treatment plant PLC reads: water level in tank (sensor), chlorine level (sensor), pump motor current (sensor). It writes: open intake valve (actuator), start chlorine dosing pump (actuator), send alarm to HMI. If an attacker can modify the PLC program or override its outputs, they control the physical process.

Functional safety is the branch of engineering that ensures hazardous systems fail safely — that when something goes wrong, the system moves to a known, safe state rather than an unknown, dangerous state. OT security professionals must understand functional safety because: (1) any security control that interferes with safety functionality may be worse than the security risk it addresses, and (2) safety systems are increasingly being targeted by sophisticated attackers who want to disable the protection before launching a physical attack.

Safety Integrity Level (SIL) is the measure of a safety system's reliability. SIL 1-4, with SIL 4 being the most critical (nuclear industry). A SIL 3 safety system in a chemical plant is designed to have a 1-in-1000 to 1-in-10,000 chance of failing on demand. A cyberattack that disables this system changes those odds dramatically — and the attacker knows this.

Modbus was developed in 1979 by Modicon for serial communication between PLCs. It was never designed for a networked environment and has zero security features — no authentication, no encryption, no message integrity, no authorisation. Any device on a Modbus TCP network can send commands to any PLC. Despite being 45 years old, Modbus TCP (port 502) is still the most widely deployed industrial protocol in the world. Shodan finds hundreds of thousands of Modbus devices exposed directly to the internet.

Modbus has only a small number of function codes. Understanding what each code does tells you exactly what an attacker is doing when you see it in network traffic.

Each industrial sector tends to use specific protocols. Power utilities use DNP3. Manufacturing uses EtherNet/IP (Rockwell/Allen-Bradley PLCs) or PROFINET (Siemens PLCs). Oil and gas uses Modbus and proprietary protocols. Water utilities use a mix of Modbus and DNP3. Understanding which protocol you're seeing tells you what type of facility you're in and what the normal traffic patterns should look like.

Every major ICS cyberattack with confirmed physical consequences has been attributed to nation-state actors. This is not because criminals lack motivation — it is because successful OT attacks require: months of reconnaissance, deep knowledge of specific industrial systems, specialised malware development capability, and tolerance for a long dwell time before effects are triggered. Only nation-state actors have the patience, resources, and risk tolerance for this.

Understanding these attacks in detail is not academic — each one reveals the attack lifecycle, the defender's failure points, and the detection opportunities that were missed. Every one of these attacks could have been detected earlier.

MITRE ATT&CK for ICS (attack.mitre.org/matrices/ics) is the OT equivalent of the Enterprise ATT&CK matrix. It maps attacker techniques observed in real ICS incidents to a structured framework. It uses different terminology from Enterprise ATT&CK because the goals and techniques differ: an ICS attacker's final goal is not data theft but physical effect — Loss of Control, Loss of Safety, Loss of View, or Manipulation of Control.

The single most important OT security control is network segmentation — creating enforced boundaries between the IT network and OT networks at each Purdue Model level. In most facilities with a security incident, investigation finds that the IT and OT networks are directly connected, often because of conveniences added over years: a business reporting database that pulls data directly from SCADA, a vendor who needed remote access and used a simple VPN, an engineer who connected their laptop to both networks simultaneously.

The Industrial DMZ (IDMZ) is the secure buffer zone between IT (Level 4) and OT (Level 3 and below). No direct connections pass through the IDMZ — all data exchange is mediated by servers in the DMZ. The architecture has three zones and two firewalls: IT network → Firewall 1 → IDMZ → Firewall 2 → OT network. A connection must be explicitly permitted at both firewalls to pass from IT to OT.

The reality of OT security: most devices cannot be patched on a reasonable schedule. You must protect them through compensating controls — security measures that reduce the risk of exploitation without modifying the device itself. This is the core skill that differentiates OT security from IT security.

Active scanning (sending probe packets to discover hosts and services) is dangerous in OT environments. Many PLCs, RTUs, and industrial switches are sensitive to unexpected traffic — a simple nmap scan has crashed PLCs in documented incidents. OT monitoring must be passive: copy the traffic using a network TAP or SPAN port, analyse it in a separate system, never send anything back into the OT network.

Passive monitoring achieves three goals: asset discovery (learn what devices exist by observing their communications — build an inventory without touching anything), baseline establishment (learn what normal communication looks like — who talks to whom, what function codes are used, what register values are normal), and anomaly detection (flag deviations from baseline — a new device communicating, an unexpected function code, an out-of-range register value).

The fundamental difference in OT IR: in IT, isolation is the first step. In OT, isolation may be impossible or more dangerous than the attack. A power plant control system under attack cannot simply be taken offline — doing so cuts power to hospitals and cities. A water treatment SCADA under attack cannot be shut down — the physical process of treating water must continue. OT IR requires simultaneous management of the cybersecurity incident and the continued safe operation of the physical process.

OT IR requires a joint team: cybersecurity personnel for the digital investigation, and engineering/operations personnel who understand the physical process well enough to maintain safe operation while the cyber incident is being managed. These two groups often have very different risk tolerances and communication styles. The security professional must earn the trust of the operations team — and vice versa — before an incident happens.

OT security is increasingly regulated — particularly for critical infrastructure sectors. Understanding the regulatory framework is essential both for practitioners working in regulated industries and for consultants advising critical infrastructure operators. The frameworks also provide structured guidance for building OT security programmes from scratch.