OT & Industrial Control Systems

How to use this topic

The first seven pages explain how operational technology works: what it is, the components of an industrial control system, how OT networks are organized, the protocols and networks they use, safety and reliability, and the power grid as a worked example. The last nine pages are about keeping OT secure: the fundamentals, the IEC 62443 standard, lessons from real incidents, monitoring, remote access, patching, incident response, regulation in the EU and the Netherlands, the United States and the United Kingdom, and where IT and OT are heading together.

Networking, security and incident response basics are covered in Networking and Security; these pages link there and focus on what is different in OT. Attacks are described so that you can recognize and prevent them; nothing here explains how to attack industrial systems.

Pages are tagged with the certifications they help with: GICSP (GIAC Global Industrial Cyber Security Professional) and ISA/IEC 62443 (the ISA/IEC 62443 Cybersecurity Fundamentals Specialist certificate).

Learning path

1. 01What Is Operational Technology?The computers that move the physical world: what operational technology is, where you find it, how it differs from IT, and why safety and availability come before confidentiality.BeginnerGICSP
2. 02Industrial Control SystemsThe building blocks of industrial control: sensors and actuators, PLCs and RTUs, distributed control systems, SCADA, HMIs and historians, and the control loop that keeps a process on target.BeginnerGICSP
3. 03The Purdue Model and OT ArchitectureHow OT networks are organized: the levels of the Purdue model, the IT/OT DMZ, zones and conduits, and how the model holds up in today's connected plants.IntermediateGICSPISA/IEC 62443
4. 04Industrial ProtocolsThe languages of industrial devices: Modbus, DNP3, IEC 60870-5-104, IEC 61850, OPC UA, PROFINET and EtherNet/IP — what each is for and why most were designed without security.IntermediateGICSP
5. 05Industrial NetworksWhat makes industrial networks different: determinism and real time, ring topologies and seamless redundancy, precise time synchronization, serial links, and one-way gateways.IntermediateGICSP
6. 06Safety and ReliabilityKeeping people and plants safe: functional safety, safety instrumented systems and SIL levels, why safety and security depend on each other, and designing for reliability.IntermediateGICSP
7. 07The Power GridHow electricity gets from power plant to socket and who keeps it balanced: generation, transmission and distribution, TSOs and DSOs, frequency, substations, control centers and the systems that run them.Intermediate
8. 08OT Security FundamentalsWhy securing OT is different from securing IT: other priorities, systems that cannot be patched or rebooted, insecure-by-design protocols, and the defenses that work in practice.BeginnerGICSPISA/IEC 62443
9. 09IEC 62443The international standard series for industrial cybersecurity: its structure, roles, zones and conduits, security levels, foundational requirements and secure development for suppliers.IntermediateGICSPISA/IEC 62443
10. 10Threats and Notable IncidentsWhat has gone wrong and what it teaches: Stuxnet, the attacks on Ukraine's power grid, Triton, Colonial Pipeline, Volt Typhoon and other incidents, explained to learn the defensive lessons.IntermediateGICSP
11. 11Asset Inventory and MonitoringKnowing what is on the OT network and noticing when something changes: passive and active discovery, building an inventory, network security monitoring and anomaly detection in industrial networks.IntermediateGICSPISA/IEC 62443
12. 12Remote Access and Third PartiesLetting vendors and engineers in without letting attackers in: secure remote access designs, jump hosts, MFA, session control and recording, and managing third-party risk.IntermediateGICSPISA/IEC 62443
13. 13Patching and Vulnerability Management in OTDealing with vulnerabilities when you cannot just patch: risk-based prioritization, maintenance windows, compensating controls, ICS advisories and working with vendors.IntermediateGICSPISA/IEC 62443
14. 14Incident Response in OTResponding when an industrial system is attacked or fails: safety first, deciding when to disconnect, running on manual operations, OT playbooks and exercises, and recovery.IntermediateGICSP
15. 15OT RegulationThe rules for critical infrastructure and OT products: NIS2, the CER Directive, the Network Code on Cybersecurity and the Cyber Resilience Act in the EU and the Netherlands, NERC CIP and sector directives in the United States, and the NIS Regulations in the United Kingdom.Intermediate
16. 16IT/OT ConvergenceWhere OT is heading: industrial IoT, cloud and edge computing, digital twins, private 4G and 5G networks and AI in OT — and how to bring IT and OT teams together safely.Intermediate

OT & Industrial Control Systems glossary

Short definitions of the terms used in this topic. The full glossary covers every topic.