Industrial security
OT security: how to protect industrial systems and the devices in them
OT security protects operational technology: the programmable systems and devices that monitor and control physical processes, such as PLCs, industrial controllers, building automation and robots. Unlike office IT, availability and safety come first, so every control is chosen so that it does not disrupt the process.
Free plan, no card required.
What is operational technology?
NIST SP 800-82 Rev. 3, the US guide to OT security published in September 2023, describes OT as a broad range of programmable systems and devices that interact with the physical environment, or manage devices that do. Its examples include industrial control systems, building automation, transportation systems and physical access control.
Industrial control systems were long isolated, ran for decades and spoke proprietary protocols. Many now connect to business networks, cloud services and remote maintenance tools, and many controllers, gateways and operator panels run commercial or open-source software, including embedded Linux. That connectivity brings IT-style vulnerabilities into the plant.
How OT security differs from IT security
The same attack techniques work in both worlds, but the priorities are different. NIST's guide addresses OT security while taking its unique performance, reliability and safety requirements into account, which is why IT tools and habits cannot simply be copied into a plant.
| Aspect | Office IT | OT |
|---|---|---|
| First priority | Confidentiality and integrity of data | Availability and safety of the physical process |
| Updates | Regular, often automatic | Planned around production; some systems cannot be updated quickly |
| Lifetime | A few years | Often much longer, sometimes decades |
| Testing | Usually possible on live systems | Active scans can disrupt controllers; tests run in test environments or passively |
| Change | Frequent | Strictly controlled, often with safety re-validation |
The main OT security risks
Most OT incidents start with weaknesses that are well understood. Guidance for industrial systems keeps pointing to the same ones:
- Flat networks, where an attacker who reaches the office network can also reach controllers.
- Remote access for vendors and maintenance that bypasses security controls.
- Default or shared credentials on controllers, operator panels and engineering workstations.
- Known vulnerabilities in outdated operating systems, firmware and third-party components that stay unpatched for years.
- Industrial protocols designed without authentication, so anyone on the network can send commands.
- Limited visibility: no complete inventory of assets, firmware versions and the software components inside them.
IEC 62443: the reference framework for OT security
The ISA/IEC 62443 series, developed by IEC technical committee 65 with the ISA99 committee, is the international reference framework for industrial automation and control system security. It organises security by role: the asset owner who runs the plant, the integrator who builds the system and the product supplier who makes the components.
For operators, the system parts define zones and conduits, risk assessment and security levels. For product makers, IEC 62443-4-1 sets requirements for a secure development lifecycle and IEC 62443-4-2 the technical security capabilities of components such as controllers, sensors and gateways. The IEC 62443 guide on this site covers the series in detail.
Where firmware and the software supply chain fit
Every controller, gateway, operator panel and industrial PC runs firmware built from components, often including open-source libraries, a Linux kernel and network services. When a vulnerability is published in one of those components, the operator and the device maker ask the same question: which products and versions contain it?
That is why a software bill of materials (SBOM) per firmware version is becoming a normal request from industrial customers. IEC 62443-4-1 asks product suppliers to manage security defects and security updates, and the EU Cyber Resilience Act will require manufacturers of products with digital elements, including many industrial components, to draw up an SBOM and handle vulnerabilities throughout the support period.
First steps for an OT security programme
Most frameworks start in the same place: know what you have, then reduce how it can be reached.
- Build an asset inventory that includes firmware versions and, where available, the software components inside each device.
- Segment networks into zones and control the conduits between them, as IEC 62443-3-2 and 3-3 describe.
- Control and log remote access, and remove default credentials.
- Track the vulnerabilities that affect your devices, using vendor advisories and the CISA KEV catalogue, and plan updates around production.
- Ask suppliers for SBOMs, security update commitments and a vulnerability disclosure contact.
Available in KROMSE today
KROMSE does not monitor OT networks, discover plant assets or inspect industrial protocols. It analyses the software and Linux-based firmware of the devices you make or run.
- Linux-based firmware images of up to 512 MB, unpacked recursively, with packages checked against OSV.dev and binaries matched offline against NVD-based vulnerability data.
- Encrypted images and bare-metal or RTOS firmware without a file system are reported as not analysable rather than as clean.
- CycloneDX and SPDX SBOMs for every scan.
- CISA KEV, FIRST EPSS, NVD and ENISA EUVD context on findings, with known-exploited vulnerabilities flagged.
Frequently asked questions
What does OT stand for in OT security?
Operational technology: the hardware and software that monitors and controls physical equipment and processes, as opposed to information technology, which handles data. Industrial control systems are the core of OT.
Is OT security the same as ICS security?
Largely. Industrial control system security is the core of OT security. OT is the broader term and also covers building automation, transportation systems, physical access control and other systems that act on the physical world.
Which standards apply to OT security?
The ISA/IEC 62443 series is the international reference, and NIST SP 800-82 Rev. 3 is a widely used guide. In the EU, NIS2 sets obligations for entities in many sectors, and the Cyber Resilience Act covers products with digital elements, including many industrial components.
Can I scan OT networks with an IT vulnerability scanner?
Not on live production systems without great care: active scans can overload or stop older controllers. OT teams usually prefer passive monitoring, scans in a test environment, or analysis of firmware and software before it is deployed.
Is KROMSE an OT security platform?
No. KROMSE does not monitor plant networks or industrial protocols. It finds known vulnerabilities in the software and Linux-based firmware of connected devices and produces SBOMs, which supports the device side of an OT security programme.