OT Security Guide: ICS, SCADA, the Purdue Model and Segmentation

Operational technology controls physical processes, so a security failure in OT can stop production, damage equipment, harm the environment or injure people, not just leak data. Industrial control systems (ICS), SCADA, distributed control systems (DCS) and safety instrumented systems (SIS) were built for decades of reliable operation, often with unauthenticated protocols, and are now connected to enterprise networks, vendors and the cloud. This guide covers the Purdue model and its limits, ISA/IEC 62443, industrial protocols, ATT&CK for ICS and landmark attacks, segmentation, remote access, monitoring, patching, safety and incident response. It is for security teams, OT engineers and plant leaders in energy, water, manufacturing, oil and gas, pharmaceuticals, food and beverage and mining.

Key takeaways

• Safety and availability come first. Test every control against its effect on the process, with operations as co-owners.
• Many OT incidents start in IT or through remote access. An industrial DMZ, brokered vendor access and separate OT credentials close the common paths.
• Know what you have before you defend it. A passive asset inventory underpins segmentation, monitoring and patching.
• Many industrial protocols trust any sender. Anyone who can reach a Modbus or DNP3 device can command it, so allowlisting and monitoring writes and mode changes matter most.
• Plan for the bad day. An ICS incident response plan, cyber process hazard analysis and the ability to run manually limit consequences.

How OT differs from IT

NIST SP 800-82 Rev. 3 defines OT as programmable systems and devices that interact with the physical environment, from ICS to building automation and physical access control. IT practice cannot simply be copied across.

Key components: PLCs and RTUs run control logic; SCADA servers supervise spread-out assets such as pipelines and water networks; a DCS controls a continuous process at one site; the engineering workstation programs controllers and is a high-value target; the historian stores process data and is often replicated to the business; the SIS runs safety instrumented functions that bring the process to a safe state independently of control. Industrial IoT (IIoT) sensors and cloud analytics now sit alongside them.

The Purdue model, the Level 3.5 DMZ and their limits

The Purdue Enterprise Reference Architecture remains the common language for where OT assets sit and which traffic may cross layers.

Limits: the model predates IIoT devices that talk straight to the cloud, cellular-connected remote sites and vendor remote support built into products, and real networks often have flat segments and dual-homed hosts. Use Purdue to describe trust boundaries, not as proof that segmentation exists; model actual flows with IEC 62443 zones and conduits.

ISA/IEC 62443, NIST SP 800-82 and joint government guidance

ISA/IEC 62443 is the international series for industrial automation and control systems (IACS) security, built on shared responsibility between asset owners, integrators, service providers and suppliers.

• Zones and conduits: a zone groups assets with common security requirements (one production line, or the SIS); a conduit is the controlled path between zones, with a documented owner, protocols and direction.
• Security levels: SL 1 protects against casual or coincidental violation, SL 2 against intentional attack with simple means, SL 3 against sophisticated means with IACS-specific skills, SL 4 against well-resourced attackers. Each zone gets a target (SL-T); components declare capability (SL-C); SL-A is what the installed system achieves.
• Seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.
• NIST SP 800-82 Rev. 3 (September 2023) is the US guide to OT security, with an OT overlay for SP 800-53 Rev. 5. A Rev. 4 draft is open for comment until 30 November 2026.
• Principles of operational technology cyber security (October 2024), led by ASD's ACSC with international partners, sets six principles: safety is paramount, know the business and its vital systems, protect OT data, separate OT from other networks, secure the supply chain, and prepare people.
• SANS five ICS cybersecurity critical controls (Lee and Conway, 2022): an ICS-specific incident response plan, a defensible architecture, ICS network visibility and monitoring, secure remote access, and risk-based vulnerability management: a sensible first-year scope.
• Consequence-driven Cyber-informed Engineering (CCE) from Idaho National Laboratory assumes the network "can and will be penetrated" and works back from the worst consequences to engineered protections, such as mechanical interlocks, that no cyber attack can override.

Industrial protocols and how to protect them

Most legacy industrial protocols were designed for closed serial networks and accept commands from any host that can reach the device. Secure variants exist but need support at both ends.

OPC UA security only helps when configured: disable the "None" policy, require Sign or SignAndEncrypt and manage certificate trust lists. Device keys and certificates from OPC UA, CIP Security and DNP3 Secure Authentication are machine identities to inventory and renew. See the Device and IoT Identity Guide and the Network Ports and Protocols Security Guide.

OT threats: ATT&CK for ICS and landmark attacks

MITRE ATT&CK for ICS (v20) has 12 tactics, including two unique to ICS: Inhibit Response Function (TA0107), which stops safety and protection functions reacting, and Impair Process Control (TA0106). The SANS ICS Cyber Kill Chain has two stages: an IT-style intrusion, then development and execution of an ICS-specific attack that needs process knowledge, so protect engineering files and historian data. Techniques to monitor:

Landmark ICS attacks and malware

Segmentation, the DMZ and secure remote access

• Industrial DMZ at Level 3.5: terminate every IT to OT session in the DMZ, replicate historian data outward and stage patches there.
• Industrial firewalls: default deny per conduit, with protocol-aware inspection that can restrict function codes (allow Modbus reads, block writes from the DMZ). See the Firewall Management Guide.
• Data diodes and unidirectional gateways: a physical data diode enforces one-way flow in hardware; a unidirectional gateway adds software to replicate historian or OPC data outward. Use them where consequences justify losing remote write access.
• Within OT: separate the SIS from process control, split lines or cells, and zone IEC 61850 station buses and wireless networks. See the Network Segmentation Guide.

Where identity fits

Triton's operators used jump boxes and valid credentials, and the Colonial Pipeline ransomware attack began with a dormant VPN account and ended in a precautionary pipeline shutdown. Identity decides who crosses a conduit:

• Vendor access: replace shared vendor accounts and always-on support tools with named accounts, phishing-resistant MFA, time-boxed approval and recording through one DMZ broker. See the Third-Party Access Guide and the Remote Access Identity Guide.
• Jump hosts: treat as tier-zero: no browsing, no IT domain trust, vault credential injection, recorded sessions. See the Privileged Session Management Guide.
• Service accounts: historian, OPC and backup service accounts often have broad rights and years-old passwords. Inventory, scope and rotate them where vendors allow. See the Service Account Security Guide.
• Separate OT identity: an OT domain with no IT trust and separate engineer admin accounts. The OT and ICS Identity and Access Guide covers shared HMI logins and device credentials.

Asset inventory, monitoring and vulnerability management

CISA's joint guidance Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators, sets out a systematic approach to an inventory and taxonomy. Record zone, Purdue level, vendor, model, firmware, protocols, addresses, criticality, owner, device accounts and logging support.

• Passive first: protocol-aware sensors on SPAN ports or taps, then vendor-approved active queries in maintenance windows. No IT scanners on Level 1 devices without engineering approval.
• What to log: remote and jump host sessions, conduit denies, PLC mode changes, logic transfers, firmware updates, new devices, write commands, Windows logs from HMIs and engineering workstations, SIS diagnostics.
• IT/OT SOC: feed OT detections to the enterprise SOC with OT playbooks and a named plant contact; no isolation of OT hosts without operations approval. See the Detection Engineering Guide.
• Assessments: CISA's free Cyber Security Evaluation Tool (CSET) supports self-assessment; an independent OT security assessment adds architecture and traffic review.

OT patch management and compensating controls

Controller and HMI patches need vendor qualification, testing and an outage (see IEC TR 62443-2-3). Prioritise internet- or DMZ-reachable devices, remote access appliances and Level 3 Windows hosts. Where a patch cannot be applied, document compensating controls: tighter conduit rules, disabled services, application allowlisting on HMIs, read-only modes and targeted monitoring. See the Patch Management Guide.

Metrics that show progress:

• Percentage of OT assets inventoried with firmware and owner.
• Internet-reachable OT devices and direct IT to OT flows (target: zero).
• Percentage of remote access sessions brokered, MFA-protected and recorded.
• Percentage of controller logic changes matched to an approved change ticket.
• Median days from critical OT advisory to patch or compensating control.
• Exercised time to restore a critical controller or HMI.

Safety, cyber PHA and incident response

• Safety and security convergence: a safety instrumented function must not depend on the control network. Keep SIS logic solvers in a dedicated zone, key switch in run, and alarm on any SIS mode change.
• Cyber PHA: process hazard analysis and HAZOP identify hazardous deviations; a cyber PHA asks whether an attacker could cause each one and whether non-programmable safeguards remain. Feed results into target security levels.
• ICS incident response: define who orders a shutdown or manual operation, how to preserve logic and historian evidence, and how to recover from offline known-good logic, firmware and HMI images. Exercise with operators. See the Incident Response Guide.
• IT incidents that reach OT: decide in advance when to sever the IT to OT conduit and what the plant needs from IT to run isolated. The Jaguar Land Rover cyberattack showed how an IT compromise can halt manufacturing for weeks.

Rolling out an OT security programme

1. Governance: name joint operations and security owners per site, adopt 62443-2-1 as the frame, and require engineering sign-off for every change.
2. Exposure first: remove internet-exposed devices, change default passwords and broker all remote access with MFA.
3. Inventory and baseline: deploy passive monitoring in learning mode, build the inventory and back up all controller logic offline.
4. Design zones and conduits: run a 62443-3-2 risk assessment with cyber PHA input; build the Level 3.5 DMZ.
5. Enforce in stages: run conduit rules log-only through a full production cycle, then enforce one zone at a time in a maintenance window, with the previous rule set saved and an engineer on site to roll back if a process alarm appears.
6. Detect and respond: alert on writes, mode changes and new devices; exercise the ICS response plan.
7. Sustain: quarterly vendor and OT account reviews, patching aligned with outages, annual 62443 gap assessments.

Decision guidance

• Firewall or data diode: firewall with protocol inspection where two-way integration is needed; diode where data only leaves and consequences are severe.
• Small sites (a water utility with a few PLCs): exposure removal, default passwords, one remote access path, logic backups and CSET. Large multi-site operators: a 62443 programme, central OT monitoring, a standard DMZ design and 62443-2-4 supplier requirements.

Framework and regulatory mapping

• EU: the NIS2 Directive (EU) 2022/2555 covers energy, transport, water, manufacturing and other sectors; Article 21 risk management measures apply to OT as much as IT.
• US electricity: NERC CIP, notably CIP-005 (electronic security perimeters and remote access), CIP-007 (systems security management) and CIP-013 (supply chain).
• US pipelines and rail: TSA Security Directives, currently SD Pipeline-2021-01E (Enhancing Pipeline Cybersecurity) and SD Pipeline-2021-02F (Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing), first issued after Colonial Pipeline, plus rail directives.

Common failure patterns

• Internet-exposed controllers with default passwords: exploited by the 2023 Unitronics campaign and again in the 2026 water utility attacks.
• A DMZ on paper only: historian, OPC Classic or vendor connections bypassing Level 3.5 via dual-homed hosts or "temporary" rules.
• Always-on vendor access: shared accounts and remote tools outside change control, unrecorded and never expiring.
• Weak jump host and IT domain trust: an OT domain trusting IT lets one IT compromise reach the plant.
• Active scanning in production: IT tools faulting Level 1 devices, costing security the trust of operations.
• No offline logic backups: recovery stalls without known-good PLC programs and HMI images.

Practitioner checklist

• Confirm monthly that no PLC, HMI or RTU is internet-reachable.
• Replace default passwords on every controller and HMI.
• Broker all remote access in the DMZ with named accounts, MFA, approval windows and recording.
• Build a passive inventory with firmware, owner and criticality.
• Document zones and conduits, and remove every direct IT to OT flow.
• Keep the SIS in its own zone with key switch protection and mode change alarms.
• Alert on mode changes, program downloads and unexpected writes.
• Store offline, tested backups of controller logic, firmware and HMI images.
• Run a cyber PHA for high-consequence processes.
• Exercise ICS incident response with operations, including manual running.

Standards and references

• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• ISA: ISA/IEC 62443 Series of Standards
• MITRE: ATT&CK for ICS Tactics
• NCSC New Zealand: Principles of Operational Technology Cyber Security
• CISA: Foundations for OT Cybersecurity, Asset Inventory Guidance for Owners and Operators
• CISA: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors (AA23-335A)
• SANS: The Five ICS Cybersecurity Critical Controls
• Idaho National Laboratory: Consequence-driven Cyber-informed Engineering

Related NHI Mgmt Group resources: OT and ICS Identity and Access Guide · Remote Access Identity Guide · Third-Party Access Guide · Network Segmentation Guide · Incident Response Guide