What is OT security in plain English?

It is the security of the hardware and software that runs physical processes on plants, sites and utilities. Unlike IT security, which usually protects data confidentiality first, OT security protects the availability of the process first, because an unavailable process is a safety event.

What does OT stand for in cyber security?

OT stands for operational technology. In a cyber security context it refers to the industrial control systems and connected devices that monitor and control physical processes, as distinct from the office IT estate that handles email, documents and business applications.

What is the difference between OT security and ICS security?

Industrial control systems (ICS) are a subset of operational technology. ICS security specifically covers PLCs, RTUs, DCS and SCADA. OT security is the broader term that also covers the networks, historians, engineering workstations and connected devices around them.

Why do OT estates need a physical air gap?

Because remote ransomware needs a reachable target and cloud recovery is often too slow or too expensive for a plant. A physical air gap keeps a known good copy of the OT gold data offline, isolated from the enterprise domain that ransomware compromises first, and available for restore at disk speed when it is needed.

Why OSS

What is
OT Security

Operational technology security in plain English, the difference from IT, and why the availability first priority ranking makes a physical air gap the backbone of OT recovery.

R5.1

Definitions

Operational Technology, In Three Definitions

Start with clean definitions for OT, ICS and what OT security actually defends against on an industrial estate.

Protecting the kit that runs the physical world

OT security in one line

OT security is the practice of protecting operational technology, the hardware and software that monitors and controls physical processes on plants, sites and utilities, from failure and attack. The priority ranking is availability first, then integrity, then confidentiality, because unavailability is a safety event.

Availability is the top prioritySafety cases drive designRecovery is a first order requirement

PLCs, RTUs, DCS, SCADA and the systems around them

What counts as OT

OT covers the field devices, controllers and supervisory systems that run industrial processes: programmable logic controllers, remote terminal units, distributed control systems, SCADA, historians and the engineering workstations that program them. Together they are usually called OT/ICS.

PLC, RTU, DCS, SCADAHistorians and HMIEngineering workstations

Ransomware, insider error and destructive attack

What OT security actually protects against

The threat model runs from accidental misconfiguration through insider error to targeted ransomware that specifically hunts industrial estates. In every case the outcome that matters is whether the plant can be restored quickly and safely from a known good copy.

Ransomware targeting OTInsider and supplier riskDestructive attacks on availability

Continue reading on the pillar guide and the OT vs IT comparison.

OT and ICS security pillar guide OT vs IT security Physical air gap for ransomware protection