Why operational technology is not information technology

The written material

The priorities are inverted, and everything follows from that

Office security is usually taught with confidentiality first: keep the data secret, keep it correct, keep it available. On a plant the order is close to reversed, and safety is added in front of all three.

Safety comes first because the process is physical. A wrong command opens a valve, starts a motor or moves a robot arm, and there may be a person standing next to it. Availability comes second because a stopped process is not a saved file that waits patiently: molten metal solidifies, a batch spoils, a furnace has to be relit over days, and a water works that stops has customers with no water. Integrity comes third, and it matters enormously, because a control system that lies to its operator is worse than one that has stopped. Confidentiality comes last, which is not to say it is unimportant.

Every disagreement between an office security team and a plant team can be traced back to this ordering, and most of them dissolve once both sides can see it written down.

Why the standard advice does not transfer

Patch promptly is the first instruction in most guidance, and on a plant it collides with three hard facts. Many controllers cannot be patched without stopping a process that may run for months. Patching outside a vendor's validated list can void support on equipment worth more than the entire security budget. And a great deal of installed plant is beyond vendor support, so no patch exists at any price.

Scan the estate is the second instruction, and on older equipment it is actively dangerous. Controllers built to hold a few connections on a quiet deterministic network can be exhausted by an ordinary scan, and a faulted controller is a stopped process. Passive monitoring, reading the traffic already on the wire, is the default for good reason.

Isolate the compromised host is the third, and on a plant isolation is not free. Cutting a control system off from the process it is regulating can leave that process without control, which is a different and sometimes worse problem than the intrusion.

None of this means the plant cannot be secured. It means the controls are compensating rather than corrective: you cannot fix the asset, so you change what can reach it.

The layered reference model

The standard way to describe a plant network is as layers, from the physical process upwards. At the bottom sit the sensors and actuators that touch the process. Above them the controllers that read and command those devices. Above those, the supervisory systems and control room screens the operator watches. Above those, the systems that manage production: recipes, scheduling, quality records. And at the top, the ordinary business network with its email, its browsers and its finance systems.

The value of the model is that it makes an obvious question askable: what is allowed to talk directly to what. In a plant that has grown rather than been designed, the honest answer is usually everything, and one compromised laptop on the business network is then three hops from a controller.

Between the production layer and the business network sits the industrial demilitarised zone. Nothing crosses it directly. A business system that needs production data reads it from a server in that zone, which the plant has written to. The plant never accepts an inbound connection from the business network, so a compromise on the office side has no path that terminates on a controller.

• Process: sensors, actuators, drives, the physical equipment
• Control: the controllers commanding that equipment in real time
• Supervisory: control room screens, alarms, historians
• Production management: scheduling, recipes, quality records
• Industrial demilitarised zone: the only meeting point, with no direct crossing
• Business: the ordinary corporate network

Zones and conduits

The standards vocabulary is worth learning because it turns an argument into a drawing. A zone is a group of assets sharing a common security requirement. A conduit is a defined, controlled path between zones. Anything not drawn as a conduit should not exist.

The discipline it forces is the point. Grouping assets means deciding what a group actually needs, and it is common to find a single flat network holding equipment whose requirements differ by an order of magnitude: a safety related system and a vending machine controller on the same segment is not an invented example.

It also gives a defensible answer to the question of how much segmentation is enough. Enough is when every path between zones is a conduit somebody has named, justified and can monitor.

Safety instrumented systems stay independent

A safety instrumented system exists to take the process to a safe state when something goes seriously wrong. It is deliberately separate from the control system, with its own sensors, its own logic and its own final elements, because a protection layer that shares components with the thing it is protecting against is not an independent protection layer.

The security consequence is direct. Convenience pressures push towards integrating the two so that everything appears on one screen and one engineer holds one connection. Every step in that direction reduces the independence the safety case was built on, and the safety case is a document somebody signed.

Where integration exists, it should be one way and it should be demonstrable: the safety system may report to the control system, and the control system may not command the safety system.

Remote access is where the boundary quietly disappears

Most plants have carefully drawn boundaries and at least one route straight through all of them, and that route is usually remote access provided to an equipment vendor.

It exists for a real reason. Modern equipment is supported remotely, the vendor's engineer is often the only person who genuinely understands the machine, and waiting for a site visit can cost more in lost production than the risk appears to be worth. So the connection is agreed once, during commissioning, by people who are focused on getting the line running.

The problems accumulate afterwards. The connection is permanent rather than requested. It uses a shared account whose password left with an employee three years ago. It is not logged, so nobody can say what was done or when. And it frequently reaches further into the plant than the one machine it was granted for.

• Access is requested and time limited, never standing
• The plant enables the session; the vendor cannot initiate it
• Individual named accounts, with multi factor authentication
• The session is recorded, and somebody on site watches it
• Reach is limited to the one asset it was granted for
• Every vendor connection appears on the asset inventory as an asset