OT (Operational Technology)

Five fundamental differences: (1) **CIA priority** — IT uses CIA (Confidentiality > Integrity > Availability), OT inverts: AIC (Availability > Integrity > Confidentiality); stopping a production line costs $100K-$10M/h, so availability is paramount. (2) **Equipment lifecycle** — IT 3-5 years, OT 15-30 years; PLCs from 1995 still in production; means unsupported OS (Windows XP/7), unpatched firmware. (3) **Patch cadence** — IT patches in 30-day cycle; OT change management requires shutdown windows (e.g., annual outage), patch only after validation in test environment, sometimes **never** (vendor support EOL). (4) **Protocols** — IT uses TCP/IP, HTTPS, modern auth; OT uses Modbus, PROFINET, EtherNet/IP, DNP3, OPC, BACnet — often **without encryption and without authentication** (designed in pre-internet era). (5) **Personnel** — IT managed by CISO/SOC; OT managed by operations engineering / plant manager (mechanical, electrical, control engineers — not cybersecurity). **Consequences**: in OT 'install antivirus' may crash PLC; active nmap scanning may freeze HMI; popular EDR may cause false positives on legitimate PLC traffic. **Rule of one**: never make changes in production OT without operations engineer approval and planned rollback.

**Purdue Enterprise Reference Architecture (PERA)** — reference network segmentation model for OT/IT, defined in the 1990s by Theodore Williams of Purdue University; **de facto standard** for OT security. Six levels: (0) **Level 0 — Physical Process** — sensors, actuators, motors, valves; measurement and execution of physical process. (1) **Level 1 — Basic Control** — PLCs (Programmable Logic Controllers), RTUs (Remote Terminal Units), DCS (Distributed Control Systems); execute control logic (e.g., 'if temp > 80, open valve'). (2) **Level 2 — Area Supervisory Control** — HMI (Human-Machine Interface), SCADA workstations; operators view process, adjust setpoints. (3) **Level 3 — Site Manufacturing Operations** — MES (Manufacturing Execution Systems), historian databases (PI System, Wonderware), batch management. (3.5) **DMZ (Industrial Demilitarized Zone)** — critical zone between OT and IT; jump servers, patch management, anti-virus update servers, data diodes. (4) **Level 4 — Site Business Planning & Logistics** — ERP, scheduling, email, normal enterprise IT. (5) **Level 5 — Enterprise Network** — corporate IT, internet. **Principle**: network traffic flows only between adjacent levels through defined paths in DMZ; **never direct Level 5 → Level 1**. **IEC 62443-3-2** standard extends Purdue with Zones (groups with similar risk profile) and Conduits (controlled communication paths) concepts.

**IEC 62443** is a series of ISA/IEC standards for industrial automation and control systems (IACS) security; de facto global standard for OT cybersecurity, mandatory in NIS2 for critical infrastructure. Series structure: (1) **62443-1** (general) — terminology, concepts. (2) **62443-2** (policies & procedures) — 2-1 IACS Security Program, 2-3 patch management, 2-4 Service provider requirements. (3) **62443-3** (system) — 3-2 risk assessment for zone/conduit, 3-3 system security requirements. (4) **62443-4** (component) — 4-1 secure development lifecycle for vendors, 4-2 component requirements. **Security Levels (SL 1-4)**: SL1 (protection against casual misuse), SL2 (intentional, low resources), SL3 (sophisticated attackers, moderate resources), SL4 (state-sponsored, extensive resources). Each zone has assigned target SL. **Foundational Requirements (FR 1-7)**: FR1 (Identification & Authentication Control), FR2 (Use Control), FR3 (System Integrity), FR4 (Data Confidentiality), FR5 (Restricted Data Flow), FR6 (Timely Response to Events), FR7 (Resource Availability). **Certification**: ISASecure (most common), TÜV Rheinland, Bureau Veritas; certificates for products (PLC, HMI), processes, organizations. **In practice**: most OT vendors (Siemens, Rockwell, Schneider, ABB, Honeywell) certify products under IEC 62443-4-2; integrators (Yokogawa, Endress+Hauser) certify systems under 62443-3-3; ICS asset owners comply with 62443-2-1 and 2-4.

Eight landmark attacks: (1) **Stuxnet (2010)** — joint US-Israel APT targeting Iran's Natanz; first-ever malware attacking SCADA (Siemens S7); destroyed 1000+ centrifuges through over-spinning; set back Iran's nuclear program 2-3 years. **Introduced 'cyber-kinetic' as concept**. (2) **Havex / Energetic Bear (2013-2014)** — APT against energy sector in USA and Europe; OPC server enumeration, ICS reconnaissance; attributed to Russia. (3) **BlackEnergy 3 / Ukraine 2015** — attack on Ukrenergo cut power for 230K residents for 6 hours; SCADA injection, HMI manipulation, KillDisk wiper; first documented cyber-attacked outage. (4) **Industroyer / CrashOverride (2016)** — attack on Kyiv power; first purpose-built ICS malware; protocols IEC 60870-5-101/104, IEC 61850, OPC DA; modular framework. (5) **TRITON / TRISIS (2017)** — attack on Saudi Arabia petrochemical (Tasnee); targeted **Schneider Triconex Safety Instrumented System** — most alarming because SIS is 'last line of defense' before explosion; attack failed but potential catastrophic; attributed to Russia (CNIIHM/Triton Group). (6) **Industroyer2 (2022)** — variant targeting Ukraine post-invasion; combined with CaddyWiper; stopped before full activation. (7) **Colonial Pipeline (2021)** — DarkSide ransomware on IT enterprise systems; **Colonial themselves shut down OT** preventatively (not direct OT attack); 5500-mile pipeline shutdown 5 days; East Coast gas shortage; demonstrated IT-OT interdependence. (8) **Pipedream / INCONTROLLER (2022)** — toolkit for ICS attacks revealed by Mandiant before use; targets Schneider M580/M340 and Omron PLCs; potential evolution of state-sponsored capabilities. **Conclusion**: most OT attacks start through IT (phishing, supply chain) → lateral movement to DMZ → OT — purely OT-native attacks rare.

Main OT protocols and their security profile: (1) **Modbus (1979)** — oldest, most prevalent; **no encryption, no authentication**; anyone in network can send 'write coil' command to PLC. Modbus TCP (port 502) visible on shodan.io thousands of times. Mitigation: Modbus over TLS (rarely deployed), VPN, segmentation. (2) **PROFINET / PROFIBUS (Siemens)** — popular in Europe; PROFINET RT (Real-Time, udp 34962-34964) and IRT (Isochronous Real-Time); PROFINET Security Class 1-3 introduces encryption but rarely enabled. (3) **EtherNet/IP (Rockwell/Allen-Bradley)** — popular in USA; CIP protocol; default port 44818; CVE-2020-15637 (Vehicle CIP) exposure and others. (4) **DNP3 (Distributed Network Protocol 3)** — power utilities, water; DNP3 Secure Authentication (SA) introduced 2007 but adoption <10%. (5) **OPC UA / Classic OPC** — OPC Classic (DCOM-based, deprecated, security-poor); OPC UA (modern, encryption, authentication) — preferred for new deployments. (6) **IEC 60870-5-101/104** — power utilities Europe; IEC 60870-5-7 introduces authentication but rarely deployed. (7) **IEC 61850** — substations; modern but GOOSE messaging lacks authentication by default. (8) **BACnet** — building automation (HVAC, lighting); BACnet/SC (Secure Connect) introduced 2018; large attack surface in smart buildings. (9) **HART/WirelessHART** — process control field instruments; security limited. **Universal mitigations**: protocol-aware firewalls (Tofino, Bayshore Networks, Belden Tofino, Claroty), unidirectional gateways (Waterfall — physical data diodes), VPN for remote access, network segmentation. **Never** expose OT protocol ports to internet; on shodan.io there are tens of thousands of exposures.

Three regulatory levels: (1) **NIS2 (EU Directive 2022/2555, transposition by October 17, 2024)** — extended NIS, covers 'essential entities' (energy, transport, banking, healthcare, water, digital infrastructure, public administration) + 'important entities' (postal, waste, food, manufacturing, digital providers). Requirements: risk management measures (Art. 21), incident reporting (24h early warning, 72h incident notification, 1 month final report), supply chain security, MFA everywhere, encryption, training, business continuity. **Penalties**: up to **€10M or 2% turnover** (essential), **€7M or 1.4%** (important). (2) **CER Directive (Critical Entities Resilience, transposition by October 17, 2024)** — physical and organizational resilience for CER entities; complements NIS2 cyber requirements with physical. (3) **NIS2 + IEC 62443** — in practice most ICS asset owners use IEC 62443 as framework satisfying NIS2 requirements. **Sectoral regulations**: (a) **NERC CIP** (USA, energy) — comprehensive set of 14 standards for bulk electric system; CIP-005 (network perimeter), CIP-007 (system management), CIP-013 (supply chain). (b) **TSA Pipeline Security Directives** (USA, post-Colonial Pipeline 2021) — mandatory cybersecurity for pipelines. (c) **EO 14028** (Cybersecurity Improving Nation's Security, 2021) — federal. (4) **Sectoral guidelines**: ENISA (EU), ICS-CERT/CISA (USA). **Compliance roadmap**: (i) classify entity (essential/important); (ii) gap analysis vs NIS2 and IEC 62443; (iii) remediation plan; (iv) incident response plan + tabletop exercises; (v) continuous monitoring and annual review.

Twelve top priorities per NIST SP 800-82r3 and IEC 62443: (1) **Asset inventory** — complete list of all OT assets (PLC, RTU, HMI, switches, historians); tools: Claroty, Nozomi, Dragos, Forescout. Critical: you don't know what you don't see. (2) **Network segmentation (Purdue)** — strict zones/conduits; firewalls between levels, jump servers in DMZ, no direct IT→OT paths. (3) **Passive monitoring** — use **passive** OT IDS (Claroty CTD, Nozomi Guardian, Dragos Platform) — active scanning may crash PLC. (4) **Protocol-aware firewalls** — Modbus/PROFINET/DNP3 deep packet inspection; whitelist legitimate commands, block 'write' commands from untrusted sources. (5) **Patch management OT-specific** — WSUS for Windows-based HMI/historian, vendor-specific for firmware; sandbox lab testing before prod; quarterly maintenance windows. (6) **Privileged Access Management** — all engineering connections through jump servers + MFA + session recording (CyberArk PSM, BeyondTrust); no shared credentials. (7) **Anti-malware OT-approved** — only vendor-certified (Symantec ICS Protection, McAfee MOVE, Trend Micro Industrial Endpoint Security). (8) **Removable media controls** — USB drives most common vector (Stuxnet); sanitization kiosks, whitelist authorized media, physical USB blockers. (9) **Backup & recovery** — air-gapped backups of PLC configuration, ladder logic, HMI projects, historian data; regular restore exercises. (10) **Incident Response OT plan** — separate from IT; collaborator with plant operations; runbook for 'PLC compromise', 'HMI lockout', 'SIS bypass'. (11) **Supply chain security** — IEC 62443-2-4 for service providers; SBOMs for new systems; vendor risk assessments. (12) **OT-specific awareness training** — operators learn differences IT vs OT, common attack patterns (USB drops, vendor laptop), reporting procedures. **Mature OT security program** = 18-36 months to baseline maturity, $500K-$5M+ initial investment for mid-size manufacturer; ROI: avoided downtime ($1-50M/incident) + compliance + cyber insurance reductions.