OT Security for Critical National Infrastructure: Key Principles

All physical things in the world are run by your operational technology. It directs the valves in a water treatment facility, manages the turbines of an energy plant, manipulates conveyor systems along a manufacturing line and ensures the moving trains have access to signalling devices. This technology has been running in a bubble for decades, physically isolated from corporate IT networks and therefore largely shielded from the cyber threats that beset traditional computing environments. This isolation has steadily dwindled as organizations have connected OT systems to IT networks for remote monitoring, predictive maintenance, and operational efficiency, leaving operational technology vulnerable to threats it was never originally designed to withstand.

In critical national infrastructure energy, water, transportation, and other OT sectors, the stakes of OT security are higher than data protection alone. A loss of a corporate database is a coo-coo. When it comes to utilities, a compromise of the systems that control something like a power grid or a water treatment facility can lead to real, tangible impacts: blackouts, poisoning, physical damage to equipment, or worse. This difference influences almost everything about the approach to OT security, which is different from conventional IT security.

You are educated on what OT security for critical national infrastructure means, but it's important to understand that OT environments act differently than IT ones. Traditional IT security starts with the assumption that the most important thing is confidentiality, keeping data from being disclosed to those who are not authorized to see it. OT security often prioritizes availability and safety because a momentary failure of an industrial control system can halt a critical process or pose a physical threat. This key difference in priorities means that security methods that work in the IT context, like aggressive patching schedules or intrusive endpoint scanning, can pose risk when simply ported to OT.

1,300 people helped install IoT systems in factories, where disposable technology is installed with life spans of decades in mind, instead of years which leads to real security tension. A programmable logic controller (PLC) installed fifteen years ago might still be working reliably today, but it was built at a time when connectivity to wider networks was not a design consideration. The problem of retrofitting security onto systems that were simply not built either with security in mind or, indeed, built to be secured at all from the outset is an order of magnitude harder, and it tells you everything you need to know about why so many threads about OT security are about compensating controls, monitoring layered around legacy equipment and network segmentation instead of replacing that equipment altogether.

Patching presents a related challenge. Prompt patching of security patches is common practice in IT systems. A patch that was not tested in OT environments can realistically be applied to a system controlling a physical process, and you may need the sprinkler to drench your computer (disruption of operations & operational safety risk). Thus, OT patching decisions must be tested and coordinated with operational teams in a manner that IT patching almost never requires, and is one of the main reasons why OT environments will often execute known-vulnerable software for months on end while security teams fully understand the risk.

The increasing connection between IT and OT networks, referred to as IT/OT convergence, has played a huge role in greater operational efficiency but also new security risk. An important part of getting OT systems connected to IT networks is that this enables useful functionality such as remote access and centralized analysis but it also adds avenues to compromise when OT systems are sitting apart from each other without those kinds of connections. If the border between IT and OT systems is too vague, an attacker who gained access to an IT network will be able to pivot into OT systems leading what would have been a contained IT incident into physical disruption in terms of operations.

This trend towards convergence has been responded to directly by the evolution of formal guidance on securing operational technology. This change is clearly articulated in the recently updated guide to OT security, which moved from an industrial control system specialization to reflecting the much broader and deeper programmable technology ecosystem interacting with the physical world, while also offering tailored guidance on managing risk trades specific to OT environments that include unique factors impacting security requirements based upon Specific Security Control Guidance aligned for low, moderate and high impact deployments typical in OT environments.

The designation of critical infrastructure sectors illustrates just how damaging their disruption could be. They are identified as critical sects exactly because their crippling will catalyze second and third order effects that would adversely impact civilian welfare, economic vitality and national security concurrently. This title is not just for show. It determines how governments view regulation, information sharing and coordinated defense across sectors since failure in one critical infrastructure organization can degrade the systems that rely on it.

A graphic overview of the critical infrastructure sectors shows just how broad this classification is, with fields ranging from energy and water to transportation to health care, all deemed so essential that their interruption would have a crippling impact on our nation's security, economy or public health and safety. Because these arms of the economy are more crucial, that leads to security expectations for organizations working in them that include certain regulatory externalities and more collaborative relationships with government cybersecurity agencies than any standard private-sector organization would see.

Organizations with successful OT security programs typically begin with visibility. A lot of organizations even find out, when they complete a full OT asset inventory for the first time, that they have devices on their networks which nobody was monitoring or securing. Without this visibility, the security teams are hampered in their ability to protect systems they do not even know exist. An accurate, continuously updated inventory of OT assets is foundational work that must precede the provision of more sophisticated security measures.

Built on that base, network segmentation, the practice of keeping OT systems logically separated from IT networks and the broader internet, where feasible, remains one of the most effective controls available. Segmentation restricts the attacker's lateral movement after compromising a segment of the environment, giving time for detection and response before a breach becomes a physical disruption. This kind of layered, safety-conscious approach, combined with diligent, proven patching practices and close collaboration between security teams and the operational staff that knows these systems best, provides critical infrastructure organizations a pragmatic path to OT security that respects both aspects of the equation, the cyber risk inherent in interconnected systems and the physical stakes.

Why is confidentiality important to OT security, but availability is more vital?

Because operational technology controls physical processes, an unplanned outage or disruption can have real safety and operational implications. In IT security, there is traditionally a greater focus on data confidentiality; in OT security, keeping systems running safely usually takes precedence.

Why is patching more complicated in OT environments than IT environments?

An unproven patch deployed to a system that is controlling any sort of physical process has the potential to cause interruptions in operations, and possibly even unsafe conditions. Unlike the more cyclical patching seen in IT, OT patching may require rigorous testing and coordination with operational teams before deployment.

How is network segmentation used in OT security?

Segmentation works by keeping OT systems logically separated from the IT network and the wider internet as well – limiting how far an attacker that compromises one part of the environment can then go and providing security teams with a greater window to detect and respond before a breach impacts physical operations.