OT Security 101. Before anyone argues about firewalls, it helps to agree what operational technology is, why it is not just IT in a hard hat, and why so many OT incidents begin on an ordinary office network. A plain-English primer for SMEs, IT generalists and engineers, with sources checked on 25 October 2026.
What OT is
The NCSC defines operational technology as “technology that interfaces with the physical world”, including industrial control systems (ICS), supervisory control and data acquisition (SCADA) and distributed control systems (DCS) (NCSC, Operational technology collection, published 18 March 2024 (opens in a new tab)). CISA’s version is much the same: systems and devices “that interact with the physical environment” (CISA, Industrial Control Systems topic page (opens in a new tab)).
In practice that means the kit that opens valves, runs conveyor belts, doses chemicals into water, keeps a cold store cold or tells a lift which floor it’s on. If IT moves information, OT moves things. A small food producer, a dental practice with a building management system or a farm with an automated milking parlour is running OT, whether or not anyone there uses the term.
The vocabulary you’ll meet as you go deeper:
- PLC (programmable logic controller): a rugged computer that reads sensors and drives motors, valves and switches.
- HMI (human-machine interface): the screen an operator uses to watch and adjust the process. Often a Windows PC.
- Engineering workstation: the laptop or PC used to program the controllers. Valuable to an attacker for the same reason.
- SCADA and DCS: systems that supervise many controllers, across a site or across a region.
How OT differs from IT
The NCSC puts the core difference in one sentence. IT security has traditionally been about confidentiality, integrity and availability, whereas “OT priorities are often safety, reliability and availability, as there are clearly physical dangers associated with OT failure or malfunction” (NCSC (opens in a new tab)). A leaked spreadsheet is bad news. A pump that won’t stop is a different category of bad news.
| Typical IT | Typical OT | |
|---|---|---|
| First priority | Protecting data | Safety and keeping the process running |
| Lifespan | Replaced every few years | Often runs for decades |
| Patching | Routine, often automatic | Needs planned downtime, testing and sometimes vendor approval |
| Rebooting | A minor nuisance | May stop production or upset a process |
| Who looks after it | IT team | Engineers, maintenance staff and equipment vendors |
Those differences explain why “just patch it” and “just scan it” can go wrong in OT. An aggressive network scan can upset older controllers, and a patch that needs a reboot may have to wait for the next planned shutdown. NIST’s Guide to Operational Technology Security (SP 800-82 Rev. 3, September 2023) (opens in a new tab) is the free, thorough reference on adapting IT security practice to these constraints. For kit that will never be patched, see When there’s no patch: how to find and fence unfixed flaws.
Why so many OT incidents start in IT
Attackers rarely begin at the controller. They begin where it’s easiest: an email inbox, a stolen password, an unpatched remote-access box. Then they follow the connections. In a SANS survey of more than 180 professionals across critical infrastructure sectors, 58% identified “IT compromises spreading into OT/IT networks” as the leading initial attack vector for ICS/OT incidents (SANS, 2025 ICS/OT Cybersecurity Budget, March 2025 (opens in a new tab)). That’s what practitioners report, not a census of every incident, but it matches the best-known cases.
Colonial Pipeline is the textbook example. Its chief executive told the US Senate in June 2021 that attackers got in through a “legacy VPN profile” and encrypted the company’s IT systems. The pipeline was shut down as a precaution, even though there was no confirmed evidence the attackers had reached the OT system (US Senate HSGAC hearing transcript, 8 June 2021 (opens in a new tab)). Norsk Hydro’s 2019 ransomware attack hit its global organisation, and parts of the business kept going on what it calls “work-intensive workarounds and manual procedures” (Hydro, Cyber-attack on Hydro, updated 15 May 2024 (opens in a new tab)).
The lesson from both: an attack that never touches a PLC can still stop production, because the plant depends on IT for scheduling, billing, remote access and, sometimes, the confidence to keep running. Government advisories describe the more deliberate version. The joint advisory on Volt Typhoon warned that the group was pre-positioning on IT networks to enable lateral movement to OT (CISA and partners, AA24-038A, 7 February 2024 (opens in a new tab)).
For the longer version, with segmentation models and vendor comparisons, see our piece Is OT security Over The Top? Purdue, IT pivots and Nozomi v Claroty.
The checklist
OT Security 101: first questions for any site (print or pin this; based on NCSC, CISA and NIST guidance, checked 25 October 2026)
- ☐ Do we know what OT we have? Controllers, HMIs, engineering laptops, building systems.
- ☐ Who owns it? Name one person on the engineering side and one on the IT side.
- ☐ What connects the office network to the plant? List every link, including the ones “only used by the vendor”.
- ☐ How do vendors and staff get in remotely, and is every route protected by MFA?
- ☐ If IT went down tomorrow, could the plant run, or stop safely, on its own? Has anyone tried?
- ☐ Are there offline backups of controller programs and configurations?
Free guidance to read next
- Secure Connectivity Principles for Operational Technology (opens in a new tab), joint guidance published by CISA on 14 January 2026, also available as an NCSC PDF (opens in a new tab).
- Foundations for OT Cybersecurity: Asset Inventory Guidance (opens in a new tab) (CISA and partners, 13 August 2025), the natural first task.
- The NCSC’s operational technology collection (opens in a new tab) for UK organisations.
- MITRE ATT&CK for ICS (opens in a new tab), a free catalogue of how attackers actually behave in industrial environments.
The Purdue model and segmentation, or how to put a sensible fence between the office and the plant, are covered in our longer piece, Is OT security Over The Top?.
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)