OT security for critical infrastructure
Securing industrial control and automation systems, Operational Technology. Safety comes first, then availability, then confidentiality.
What OT security covers
Operational technology, OT for short, controls physical processes. That includes the programmable logic controller, the PLC, the operator display in the control room, the HMI, the process control or SCADA system above it, and the historian recording the measurements. Together they make up the industrial control system, the ICS.
OT security protects that control technology. It uses the same tools as IT security under different constraints. A server can be restarted, a turbine cannot. So safety comes first, then the availability of the process, and only then the confidentiality of the data.
Why OT has rules of its own
Industrial control and automation systems make different demands than classic IT. Four points define the situation.
Different priorities
In OT, safety comes first, then availability, then confidentiality. A plant must not stop, a process must not tip.
A life measured in decades
Plants run twenty years and more in the same configuration. For many devices no update exists, and where one does, the date depends on the process rather than the calendar.
Protocols without a login
Modbus TCP, classic S7comm and IEC 60870-5-104 were designed for closed networks and still transmit without authentication. OPC UA provides for security. Whether it is switched on is a question to be checked.
A growing attack surface
With IT and OT converging, process networks hang off the office IT, remote maintenance is added, and old controllers become reachable. That seam is where we test.
The order this usually runs in
Almost every conversation about OT security opens with one of these five sentences, and which one it is usually settles what comes first. Anyone who builds components rather than operating them starts elsewhere, in the security lab.
Visibility
“We do not know what runs on our plant network.” It starts with an OT assessment that records the actual communication passively. Until that picture exists, every measure is a guess.
Zones and evidence
“We have to produce evidence, for a regulator or a customer.” The communication picture turns into a zone concept with protection levels, and from there into what an assessor is shown. That is OT compliance.
Detection
“If somebody were on the network, we would not notice.” Only once normal operation is known can a deviation be defined. Sensors on the process network and the rules on top are the job of the OT SOC.
Exercise
“The technology is in place, but in an emergency nobody knows who decides.” Whether to shut down is decided under time pressure and rarely on complete information. That gets practised in OT crisis exercises.
Training
“Our people know the plant, but not the attack paths.” OT Security Training runs in two stages on a live lab plant. After it the team carries the operation itself.
Five categories for OT.
Every category is cut for industrial environments. Testing runs without interrupting operation, critical steps are agreed beforehand and take place in agreed windows or on test rigs.
- OT penetration testing and assessments OT and ICS, SCADA, IEC 62443 risk assessment.
- OT SOC, SIEM and monitoring OT monitoring, anomaly detection, SIEM integration.
- OT cyber exercises and crisis management Red, blue and purple team, tabletop, crisis simulation.
- OT compliance and consulting KRITIS, IEC 62443, NIS2, network segmentation.
- OT Security Training OT awareness, live hacking on ICS.
Tested in our own OT lab.
Our procedures come from real plant, not from a whiteboard. In the OT lab we run demonstrators from several sectors, on which attacks and defences can be played through reproducibly.
YekCity
Built from the analysis of real attacks on power and utility networks: a model city with real controllers, on which those attacks can be replayed, detected and practised.
YekTrain
Vehicle systems on MVB and CANopen, built from recordings of real trains. Attacks and their detection can be shown on it reproducibly.
YekCar
Emulated control units with CAN, UDS and keyless entry, with an attacker dashboard and an IDS monitor in the same case.
What OT has to be measured against.
These frameworks are the reference for our tests. The formal classification is one you make with your own compliance people.
IEC 62443
A series of standards with technical and organisational requirements. 2-1 describes the programme, 3-2 the zones, 3-3 the system requirements. To the compliance advice
NIST SP 800-82
A guide to securing industrial control systems, widely used as a yardstick in testing. To the OT assessment
ISO 27019
Information security for energy utilities, as an addition to ISO 27001. For energy utilities
KRITIS and § 31 BSIG
For operators of critical infrastructure, § 31 BSIG requires systems for detecting attacks, with evidence every three years. To the section on attack detection
NIS2
The EU directive on cyber resilience, anchored in German law through the NIS2 implementation act. To the NIS2 advice
Common questions on OT security
Protecting the technology that controls a physical process. That covers controllers, operator displays, control and process control systems, the historian and the networks between them. It is secured against failure, manipulation and unauthorised access, without the process coming to a halt.
In the order of the protection goals and in the means that are permitted. IT puts the confidentiality of data first, OT the safety of people and plant. A vulnerability scan that passes unnoticed in an office network can throw a controller out of step. So in OT the work starts passively.
A true air gap is rare, and it rarely holds. The way in runs through the vendor's remote maintenance, the service laptop in the cabinet, USB media during commissioning, radio links to outlying sites, and the production data leaving the plant. Stuxnet reached an air-gapped plant. We check first whether the separation actually holds in operation. In most plants there is at least one path nobody had in mind.
Operators of critical infrastructure, through the BSIG as amended by the NIS2 implementation act. § 31 BSIG requires them to run systems for detecting attacks and to provide evidence every three years. NIS2 adds further sectors and smaller companies, and OT systems are expressly included. Whether your company is affected depends on sector, size and turnover.
With visibility. Until it is established which devices on the plant network talk to each other and by which routes, every measure is a guess. An assessment records the actual communication passively and produces the picture that segmentation, detection and exercises build on.
Most of it, yes. Architecture analysis, configuration review and the evaluation of recorded communication all run during operation. Active tests happen only in agreed windows, on spare or lab rigs, with abort criteria fixed beforehand. Where an answer could only be had by intervening, we reproduce it on our own hardware.
Not inside the plant. An IT IDS knows web, mail and Windows traffic and brings signatures for those. It does not decode Modbus TCP, S7comm or IEC 60870-5-104; it sees a TCP connection and nothing more.
Then there is the real problem. An attack on a controller looks like a valid command, because it is one. What makes it stand out is that it arrives at the wrong time, from the wrong device, or with a value the process cannot produce. Only somebody who knows normal operation sees that.
And a warning about the operating mode. An IPS that blocks on its own can cause a disturbance in a process network. In OT you read along rather than intervene.
A combination of sensors on the plant network, an analysis layer, and the rules in between. The sensors read the traffic, the analysis compares it against normal operation, and the rules decide what counts as an alarm. For KRITIS operators this is an obligation under § 31 BSIG, with evidence to the BSI every three years. What is required is not only technology but the documentation of what was actually detected and how it was answered.
Keep your OT in view.
A first conversation usually takes 30 minutes. We listen, place your situation and say frankly which test fits your plant.