Operational technology (OT) includes programmable logic controllers, control systems, operator panels, sensors and drives, but also heating, ventilation and access control systems. Many of these components were developed at a time when networking and attacks from the internet hardly played a role. For a long time, these systems ran in isolation. Through remote maintenance, connection to ERP systems and analytics in the cloud, they are now connected to office IT and the internet. An attack on OT can stop production, damage equipment or endanger people.
How OT security differs from IT security
- Different priorities: In IT, confidentiality is often the main focus. In OT, availability and safe operation come first.
- Long lifecycles: Plants often run for decades. Outdated operating systems are not uncommon, and updates are often only possible in maintenance windows or not at all.
- Insecure protocols: Many industrial protocols were designed without encryption and authentication.
- Sensitive systems: Active network scans, which are common in IT, can disrupt controllers.
A widely used framework for OT security is the IEC 62443 series of standards. It divides plants into zones with similar protection requirements and regulates the connections between these zones.
Typical examples
- For remote maintenance, a machine manufacturer has built its own cellular router into the control cabinet, bypassing the firewall.
- Ransomware in the office network spreads into the production network and shuts down plants.
- The building automation is on the same network as the workstations.
- An old operator PC without updates controls a central plant.
What companies should keep in mind
- Create an inventory: Record all controllers, operator stations, firmware versions and connections.
- Separate IT and OT: Isolate production and building technology from the office network through network segmentation with controlled transitions.
- Consolidate remote access: Provide vendor access centrally, personalized, time-limited and logged.
- Plan for outages: Create backups of control programs and configurations, and practice emergency operation.
- Demand it in procurement: Include security requirements and commitments to updates in tenders for new plants.
Responsibilities between IT, production and building services should be clearly defined. For companies within the scope of NIS2, OT systems also fall under the required risk management for network and information systems.
View security expertise