Operational Technology (OT) and Industrial Control Systems (ICS) run factories, power, water and pipelines. When they're attacked, the impact is physical - and the protocols were built for reliability, not security.
Why OT is different
- Protocols with little/no auth - Modbus, DNP3, S7comm, EtherNet/IP were designed for trusted networks. A write command is often just... accepted.
- Fragile, long-lived devices - PLCs and HMIs can't be patched like servers; an aggressive scan can crash them.
- Availability over confidentiality - you can't just "reboot the turbine."
The dangerous crossover
Most OT incidents start in IT and pivot across the boundary. An attacker who reaches an engineering workstation can issue unauthorized ladder-logic or setpoint writes to PLCs.
How to defend
- Segment IT from OT with a monitored, minimal boundary (the Purdue model).
- Baseline who may write to PLCs - alert on control commands (e.g. Modbus write-coil / write-register) from non-engineering stations.
- Deploy protocol-aware monitoring (passive) - it understands Modbus/DNP3, unlike generic IT tooling, and won't disrupt devices.
- Alert on the unusual: firmware uploads, PLC stop/program-mode changes, new devices on the OT LAN.