Operational technology (OT) in plain English
Many companies have two kinds of technology. Classic IT processes information: emails, accounting, customer data. OT, by contrast, acts on the physical world. It opens valves, regulates temperatures, moves robotic arms, and switches conveyor belts on and off.
Think of IT as a company’s office and OT as its engine room. If a computer fails in the office, it’s annoying. If the engine room grinds to a halt, production stops – and in the worst case, people or the environment are at risk.
For a long time, OT systems were isolated from the internet and the office network. Today, they are increasingly connected – for remote maintenance, real-time production data, or links to cloud services, for example. That also puts them within reach of cyberattacks.
How OT works
OT environments consist of several layers that work closely together:
- Sensors and actuators: Sensors measure values such as pressure or temperature; actuators carry out commands – for example, motors, valves, or pumps.
- Controllers: Programmable logic controllers (PLCs) process the measurements in real time and switch the actuators.
- Operating and monitoring: At operator stations (HMI, human-machine interface), employees monitor the process. SCADA systems and process control systems provide an overview of entire plants or distributed sites.
- Connection to IT: Interfaces transfer production data to planning and analytics systems on the office network.
Together, these components form industrial control systems (ICS), the core of many OT environments. Three characteristics fundamentally distinguish OT from office IT:
- Availability and operational safety come first: In IT, the focus is often on protecting confidential data. A plant, by contrast, must first and foremost run reliably and must not endanger people or the environment – experts call this functional safety.
- Long life cycles: Controllers often remain in service for decades, sometimes with operating systems that no longer receive updates. Even when an update is available, installing it or restarting often means halting production.
- Insecure protocols: Many industrial protocols – the “languages” controllers and devices use to communicate with each other – were developed for isolated networks and support neither authentication nor encryption. Anyone with access to the network can send commands.
A practical example
A food manufacturer separated its office and production networks years ago – at least on paper. A penetration test reveals that a maintenance computer on the production floor is connected to both networks. In addition, the equipment supplier has a permanently open remote maintenance connection, secured only with a default password.
Starting with a phishing email on the office network, an attacker could thus make their way to the controls of the filling line. There, they could alter recipes or stop the line. The measures are clear: properly separate the maintenance computer, allow remote maintenance only after approval and with multi-factor authentication (MFA), and replace default passwords.
Why does this matter for businesses?
An attack on OT hits the core of the business: production outages, damaged equipment, quality problems, or hazards to people and the environment. Even malware that only encrypts office IT can paralyze production if the two worlds aren’t properly separated.
Then there are regulatory requirements. Operators of critical infrastructure and many companies covered by NIS2 – for example in energy, water, chemicals, or machinery manufacturing – must also adequately secure their OT. The IEC 62443 series of standards provides an internationally recognized framework for this, for example by dividing plants into security zones connected by controlled communication paths (conduits).
At the same time, caution is called for: a careless network scan can crash older controllers. Security testing in OT therefore requires experience, close coordination, and often passive methods.
How to protect your organization
- Take inventory: Record all OT components, their connections, and every remote maintenance access point.
- Separate networks: Separate office IT and OT through effective network segmentation – dividing the network into separate zones – with strictly controlled connections between them.
- Control remote maintenance: Enable access for service providers only when needed, secure it with MFA, and log every session.
- Replace default passwords: Change preset passwords on controllers, operator stations, and network components.
- Plan updates: Install security updates in coordinated maintenance windows. Where that isn’t possible, protect systems by isolating them further.
- Detect anomalies: Monitoring OT network traffic makes unexpected connections and commands visible.
- Test regularly: Have your network separation tested to see whether it holds up in practice as well as it does on paper.
How Rootsektor can help
In an OT penetration test, we examine controllers, industrial protocols, remote maintenance access, and the separation between IT and OT – tailored to your operations, with agreed test windows and, where necessary, passive methods. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person. You can request your fixed-price quote after scoping via our Pentest Quote page.