What Is OT Security?

Operational technology security is where IT practice most often does active harm. A control that is routine in a data centre — patch on a schedule, scan the network, isolate a suspicious host — can stop a process, damage equipment or remove an operator's visibility of something physical and dangerous.

The discipline is not IT security applied to industrial kit. It is a different set of priorities.

The priority inversion

In IT the usual ordering is confidentiality, integrity, availability. In OT it reverses, and a third concern sits above all of them.

This is why “isolate the host” is not a universally available response. Removing an operator's view of a running process can be more dangerous than the intrusion.

IT/OT convergence is the actual risk

Historically these estates were separate, and security rested on that separation. Business demand for production data, remote support and analytics has connected them, usually incrementally and often without a diagram.

The recurring assessment finding is not a sophisticated attack path. It is a flat plant network, a shared engineering workstation, and a vendor tunnel installed at commissioning that nobody in IT knows exists.

Compensating for equipment you cannot patch

• Segment aggressively, because the network is the only layer you fully control
• Monitor passively with a tap and an OT-aware sensor, which gives asset discovery without sending a packet at a controller
• Broker vendor access — authenticated per engineer, time-boxed, recorded
• Control removable media, since updates frequently arrive on a USB stick carried to site
• Write an OT-specific incident plan with operations rather than for them; a plan instructing responders to isolate systems will not survive contact with a control room

Starting from nothing

For an operator with no programme, the order that works is fixed by dependency rather than preference. Passive asset discovery at one representative site comes first, because every subsequent decision needs the inventory. Then an architecture review establishing what can genuinely reach what, which is rarely what the diagram shows. Then a vendor access inventory, asked of the vendors directly rather than inferred from firewall rules.

Only then does segmentation design make sense, and only after that does monitoring have somewhere to sit. Operators who buy monitoring first end up watching a network they cannot describe.

Where to start

Establish whether a phished office workstation can reach the control network, directly or through a shared device. If the answer is yes or nobody is certain, that is the whole programme until it is no.

See OT and ICS security for oil and gas operators, Alberta Regulation 84/2024 and manufacturing uptime. GuardsArm delivers OT and ICS security.