OT Cybersecurity Without Downtime.
OT cybersecurity, or OT security, protects the systems that run physical processes: the PLCs, RTUs, HMIs, SCADA and DCS behind a plant, a grid or a pipeline. Most ways of adding OT security require a production stop. This guide explains what OT security is and how to put its controls in front of running assets, with no change to the controllers.
Last updated:
OT security is the set of controls that keeps industrial control systems safe, available and trustworthy. It covers four questions:
- who can reach a controller
- what they are allowed to do to it
- how zones are separated
- what evidence is kept
It differs from IT security because the process cannot stop. To work within that constraint, enforce identity, segmentation and audit in front of the asset, in the access path. Nothing is installed on the controller, nothing is re-addressed, and the maintenance window is used only for firmware.
What is OT security?
Operational technology (OT) is the hardware and software that monitors and controls physical equipment: pumps, valves, conveyors, compressors, breakers, machine tools. OT security, also called OT cybersecurity or industrial control system security, is the discipline of protecting that equipment, and the networks it runs on, from unauthorized access, manipulation and disruption.
OT security keeps data confidential, and it also keeps the process running as designed and keeps people safe. A compromised file server leaks documents. A compromised controller can open a valve, stop a line or push a process outside its safe limits. For this reason, OT security puts availability and integrity first, and its controls must not disrupt the process they protect.
What OT security protects
PLC
Programmable logic controller. Runs the logic that drives a machine or a process step. Usually reachable over Modbus, S7comm or EtherNet/IP, with no authentication of its own. See PLC security.
RTU
Remote terminal unit. Collects field data and executes commands at remote sites such as pump stations, substations, wellheads and compressor stations, often over cellular or radio links.
HMI
Human-machine interface. The operator screen that reads from and writes to controllers. Often an older Windows machine that cannot be patched on IT's schedule.
SCADA
Supervisory control and data acquisition. Centralizes monitoring and control across many sites, which makes the SCADA server one of the highest-value targets in the estate. See SCADA security.
DCS
Distributed control system. Runs continuous processes inside one facility, such as refining, chemicals or power generation, with controllers spread across the process.
CNC
Computer numerical control. Machine tools that load part programs over the network and are frequently maintained remotely by the company that built them.
Around these assets sit engineering workstations, historians, and the vendor laptops and remote sessions that keep them running. Those access paths are where most intrusions enter, which is why the controls in this guide concentrate on them. The Purdue model is the usual map of how these layers stack, from field devices up to enterprise IT.
How OT security differs from IT security
IT security and OT security share tools and many threats, but they work under different constraints. IT security protects data and can usually restart a system to fix it. OT security protects a physical process that is expected to run for months or years without stopping, on equipment that was never designed to defend itself.
| Dimension | IT security | OT security |
|---|---|---|
| First priority | Confidentiality of data, then integrity, then availability | Safety and availability of the process, then integrity, then confidentiality |
| Patching | Regular cycles, reboots accepted | Tied to scheduled shutdowns and vendor qualification; some devices are never patched |
| Endpoint agents | Standard on laptops and servers | Impossible on controllers, often unsupported by the vendor on HMIs and servers |
| Equipment lifespan | Replaced every few years | In service for a decade or more |
| Protocols | Authenticated and encrypted by default | Modbus, DNP3, S7comm and others, often with no authentication or encryption |
| Cost of a failure | Data loss, service outage | Lost production, damaged equipment, safety incidents, interrupted public services |
| Who owns the system | IT and the security team | Operations and engineering, often with the equipment vendor |
As a result, controls that work in IT by changing the endpoint often cannot be applied in OT, and the ones that can usually need a stop. For a longer comparison, read the difference between IT and OT cybersecurity.
Why OT security matters now
Isolated plants are now connected
Plants that were once islands now talk to the enterprise network for production data, to analytics platforms, and to equipment builders for remote maintenance. The growth of the industrial internet of things (IIoT) adds more connected devices every year. Each new connection is a path to a controller designed on the assumption that nobody hostile could reach it.
Legacy equipment cannot defend itself
Much of the installed base was built before security was a design requirement. Controllers accept commands from anyone who can reach them, and HMIs run operating systems their vendor no longer supports. New vulnerabilities in OT products appear in CISA's ICS advisories most weeks, and many concern devices that will not be patched soon.
Third parties maintain much of the equipment
Integrators and equipment builders maintain a large share of OT equipment, often through remote access tools that stay open between visits. Shared, standing vendor access is one of the most common ways into a plant, and one of the hardest to see.
Regulators expect controls at the OT layer
IEC 62443, NERC CIP for the North American grid, federal and state rules for water utilities, and the TSA pipeline security directives all expect access control, segmentation and evidence at the controllers, in addition to the corporate perimeter.
Why most OT security approaches cost downtime
When an OT security project stalls, the cause is rarely the budget. The cause is usually the outage window. Most controls borrowed from IT change something on the asset or on its network, and in a running plant every change needs a stop, a test and a rollback plan.
Endpoint agents
An agent has to be installed, and on an HMI or an engineering workstation that usually means a restart, a compatibility check with the control software and the vendor's approval. On a PLC, RTU or CNC there is nowhere to install one at all. Agent-based OT security protects the Windows layer and leaves the controllers unprotected.
Re-IP and VLAN redesign
Segmentation projects often start by re-addressing the network: new subnets, new VLANs, new firewall zones. In OT, IP addresses are written into controller programs, HMI projects and SCADA tag databases. Changing them means reconfiguring and revalidating each one, cell by cell, during planned outages.
Firmware patching
Patching fixes a vulnerability at its source, and it should still happen. But a controller firmware update means stopping the process it runs, and vendors often need to qualify the update first. The result is a patch backlog measured in shutdowns, and devices that stay exposed until the next one, or indefinitely once the product reaches end of life.
Rack rebuilds for inline firewalls
Putting a classic firewall in front of a cell means new hardware in the cabinet, recabling the path to the cell and tuning rules during production. Most firewalls filter ports. They cannot recognise a Modbus write or an S7 program download, so the rules are often either too loose to block an attack or too strict for the process to run.
The downtime cost of common OT security approaches
What each approach has to touch, and the stop it usually needs. The last row is the approach this guide recommends.
| Approach | What it touches | Downtime it needs |
|---|---|---|
| Endpoint security agent | Software on HMIs, workstations and servers. Controllers cannot run one. | A restart and a qualification window per host, plus vendor approval. Not possible on PLCs, RTUs or CNCs. |
| Re-IP and VLAN redesign | IP plan, switch configuration, and every controller, HMI and SCADA project that references an address. | A planned outage per cell while addresses change and communications are revalidated. |
| Firmware patching | The controller itself. | A controller restart, usually inside a scheduled shutdown, often after vendor testing. |
| Inline firewall with a rack rebuild | Cabinet space, cabling and the physical path to the cell. | A cutover window while cables move and rules are tuned against live traffic. |
| Passive monitoring (SPAN or tap) | A mirror port on a switch. | Usually none. It copies traffic, so it detects but does not block. |
| Controls in front of the asset (industrial proxy) | Nothing on the controller. Enforcement sits in the access path to the asset. | Designed for none: no agent, no change to the machine, cutover without IP renumbering or VLAN redesign. |
Monitoring and patching both belong in a mature program. You still need to decide where to enforce policy. If you can only apply controls that need a shutdown, most of the plant stays unprotected between shutdowns.
How to put OT security controls in front of the asset
This approach leaves the controller unchanged and controls the path to it. An industrial proxy sits in the access path in front of the asset, terminates each session, authenticates the user, authorizes the specific command and records it, before anything reaches the PLC, HMI or SCADA server behind it. Trout's Access Gate puts that compute on the wire, directly in the data path, next to the industrial assets. A proxy placed in front of one targeted machine is what we call a Secure Operation Twin.
01Nothing installed on the asset
The PLC, HMI, SCADA server or legacy application server installs nothing and does not change. All enforcement happens at the proxy, so the approach is agentless on every asset.
02No re-IP, no VLAN redesign
The proxy is placed transparently in the path to the asset and cuts over without IP renumbering or VLAN redesign. Controller programs, HMI projects and SCADA tag databases keep the addresses they already use.
03Protocol-aware, not port-based
Because it parses industrial protocols such as Modbus, DNP3, S7comm, EtherNet/IP and OPC UA, the proxy can allow a register read and deny a write, or record a program download as its own event. You write a rule instead of redesigning the network.
04The control loop stays off the enforcement path
The proxy governs the north-south sessions that people, vendors and engineering workstations use to reach an asset. The cyclic control traffic and the safety system stay off the enforcement path, so they take no added latency and keep running if the proxy is offline.
05Built for resilience
It runs with failover and a logged break-glass path. You decide per asset whether it fails open or fails closed, so it does not become a single point of failure for the running process.
An industrial proxy controls the access path to a controller. It does not sit in the control loop. If the proxy is removed, a vendor can no longer reach the asset, and the process the asset runs continues without interruption.
What changes on site
For operators, nothing changes on the screen. The HMI talks to the same controller at the same address, and the process runs as it did before.
For engineers and vendors, the path changes. They keep their VPN or 4G link, reach an asset through the gateway, sign in with their own identity and MFA, and see only the assets and operations they are allowed to use. Staff can sign in against your corporate directory and vendors against a separate one. A vendor session to one machine does not open the rest of the network, and it ends when the job ends.
For the security team and auditors, every session and every denied command is recorded in one place, tied to the person who ran it and the asset it touched. Frameworks such as IEC 62443 and NERC CIP expect operators to produce this kind of evidence.
This approach does not replace patching. It changes when patching has to happen. Once access to the device is controlled in front of it, a firmware update can wait for the window it needs, and that window is used only for firmware. For placement choices, inline or out of band, see what an industrial proxy is.
The cost of downtime in manufacturing, utilities, and oil and gas
In every industry, the goal is to secure the running operation without stopping it. Each industry measures the cost of a stop differently, so each one asks for different controls first.
Manufacturing
Downtime is priced in lost production per hour.
On a production line, every hour of unplanned stop is output that does not ship, and a security change that needs a line stop is usually postponed in favour of the production schedule. Plants also run equipment from several decades side by side: CNC machines and robot cells maintained by their builders, and PLCs that were commissioned once and never touched again.
The first controls manufacturers ask for are secure remote maintenance for machine builders, segmentation between cells so one infected workstation cannot reach every line, and protection for legacy controllers that cannot be patched. All three can be placed in front of the equipment without stopping the line.
Utilities: water, wastewater and power
Downtime is priced in service continuity to the public and to regulators.
A utility cannot stop treating water or delivering power to install a security tool. Its outage is a public event, reported to regulators and felt by every customer. Many small and mid-size utilities also run without dedicated OT security staff, across treatment plants, pump stations and substations connected over long links.
Water and wastewater utilities work under EPA and CISA guidance and, in states such as New York, under their own OT rules. Electric utilities answer to NERC CIP, which routes interactive remote access through an Intermediate System and, with CIP-003-9, extends vendor remote access controls to low-impact assets. In both cases the controls in front of the asset, identity-bound remote access, segmentation and recorded sessions, are what the rules ask for, applied without an outage.
Oil and gas
Downtime is priced in process safety and in trips to unmanned remote sites.
A pipeline or a gas processing plant cannot trade safety margins for a security change. An unplanned stop can mean flaring, a pressure excursion or a restart that has to be sequenced carefully. Much of the infrastructure is also unmanned: wellheads, compressor stations, metering points and block valves reached over cellular, radio or satellite links, where a change that goes wrong means sending a crew.
In the United States, the TSA pipeline security directives, starting with Security Directive Pipeline-2021-02 and its revisions, require pipeline owners and operators to segment IT from OT, control access to OT systems, monitor continuously and maintain a cybersecurity implementation plan. API 1164, the American Petroleum Institute standard for pipeline control system cybersecurity, sets the industry baseline for the same SCADA environments. Controls placed in front of RTUs and SCADA servers address the segmentation and access-control expectations site by site, with the same policy at every location and no agent on field equipment.
The first OT security controls to put in place
OT security programs that try to do everything at once often stall. Programs that make progress start with the controls that close the most common paths into the plant, and choose an implementation that does not need a shutdown.
Secure remote access for staff and vendors
Many OT intrusions start on a remote access path: a shared VPN account, a remote desktop tool left running, a forgotten modem. Keep the VPN or 4G link, and add a gateway that replaces standing access with time-limited sessions to one asset, tied to a named person, with MFA at the gateway and a recording of what was done. Staff and vendors can sign in against separate directories.
Read the secure OT remote access guideSegmentation without rewiring
Separate IT from OT, and cells from each other, so an intrusion stays where it started. Enforce IEC 62443 zones and conduits as policy in the path, instead of running a VLAN and re-addressing project.
See OT segmentation without rewiringProtection for controllers you cannot patch
For PLCs and RTUs with known vulnerabilities and no patch window, restrict who can reach them and which commands they accept. This is a documented compensating control.
Read the PLC security guideVulnerability triage from advisories
Decide which published ICS vulnerabilities matter to your plant, and what to do when the vendor has no patch and the device will not be restarted this quarter. In that case, limit who can reach the device until the firmware can be updated.
Browse ICS security advisoriesA framework to measure against
IEC 62443 gives OT security a common language: security levels, zones, conduits, and requirements for asset owners and suppliers. Mapping controls to it produces evidence that auditors and insurers recognize.
Read the IEC 62443 guideHow to build an OT security program, step by step
The order of the steps matters more than the choice of tools. You can do each step below on a running plant. Only the last step depends on shutdown windows.
01Inventory what is on the network
Build an asset inventory from passive discovery and from engineering records: controllers, HMIs, servers, remote access paths, and who uses each of them.
02Assess risk by consequence
Rank assets by what happens to the process if they are misused, not by vulnerability score alone. Structure the assessment with a recognized framework such as the NIST Cybersecurity Framework or an IEC 62443 risk assessment.
03Control the remote access paths
List every way in from outside and retire shared accounts and always-on tools. Route the remaining VPN and 4G connections through one controlled, recorded gateway with MFA.
04Segment IT from OT, then zones within OT
Contain lateral movement at the IT/OT boundary first, then between cells, sites or process areas, so one compromised workstation cannot reach the whole estate.
05Enforce least privilege per asset
Give each user and vendor access to the assets and operations their job needs and nothing more. In OT that goes down to the command: read, write, program download.
06Monitor and keep evidence
Log every session and every denied action, watch east-west traffic for anomalies, and keep records in a form auditors can read. Documented controls speed up audits and show where to improve next.
07Train the people who run the plant
Operators, engineers and contractors are part of the control. Show them how remote access now works, what the new rules are, and how to report something unusual.
08Patch in the windows you have
Keep patching on the schedule the process allows. When access is controlled in front of the device, you can schedule the patch backlog, and the devices stay protected until they are patched.
Independent validation
Two independent assessments stand behind the approach described in this guide.
Overlay security for brownfield OT, validated by Irish Manufacturing Research
In an industrial OT testbed representing a brownfield plant network, Irish Manufacturing Research (IMR) validated Access Gate across five protocols: Modbus TCP, OPC-UA, MQTT, web and RDP. Its core finding is that a network overlay can enforce stronger security while preserving the behaviour of industrial communications, without agents on legacy devices, without re-IPing production assets and without redesigning the underlay network. Unauthorised Modbus writes, control-topic publishes and lateral pivots were denied and logged while the underlying process kept running.
Read the IMR validationEdge log processing, benchmarked by HUN-REN SZTAKI
The evidence an OT security program produces has to reach a SIEM without overwhelming it. As part of the EU-funded SOCCER project, HUN-REN SZTAKI benchmarked Trout's Impeller edge log engine against Logstash across eight scenarios: an 80 MB image that is 91% smaller, a 2-second startup, and 3 to 13 times less CPU per event.
Read the Impeller validation reportQuestions about OT security
agents installed on PLCs, RTUs, HMIs or SCADA servers to put these controls in place.
OT security, or OT cybersecurity, is the protection of operational technology: the PLCs, RTUs, HMIs, SCADA and DCS systems that monitor and control physical processes in plants, utilities and pipelines. Its first goals are safety and availability of the process, then integrity of control, then confidentiality of data. In practice it means controlling who can reach each asset, what they can do to it, how zones are separated, and what evidence is kept.
IT security protects data and can usually restart a system to fix it. OT security protects physical processes that must keep running, on equipment that often cannot run an agent, cannot be patched on demand and speaks protocols with no authentication. IT puts confidentiality first; OT puts safety and availability first. That is why OT controls lean on the network and the access path rather than on the endpoint.
Yes, for access control, segmentation and audit. Placing enforcement in front of the asset, in the access path, means nothing is installed on the controller and nothing is re-addressed, and the cyclic control traffic stays off the enforcement path. Irish Manufacturing Research validated this overlay approach without agents on legacy devices, without re-IPing production assets and without redesigning the underlay network. Firmware updates still need their own maintenance window; this approach lets them wait for it safely.
Remote and vendor access paths that stay open between visits, flat networks where one compromised workstation can reach every controller, legacy devices that cannot be patched, industrial protocols with no authentication, and intrusions that start in IT and move into OT. Most of these are access problems, which is why remote access control and segmentation are usually the first controls to put in place.
They should not. PLCs, RTUs and CNC controllers cannot run security agents, and many HMIs and servers are not supported by their vendor with one. Agentless approaches enforce identity, segmentation and audit at the network, in front of the device, so the controller itself is never modified.
IEC 62443 is the core international standard for industrial automation and control systems. NIST SP 800-82 gives US guidance for ICS. NERC CIP is mandatory for the North American bulk electric system. US pipeline operators follow the TSA security directives, with API 1164 as the industry standard for pipeline control systems, and water utilities follow EPA guidance and state rules.
SCADA security protects the supervisory systems that monitor and control distributed assets such as pipelines, water networks and power grids: the SCADA servers, the communication links, and the RTUs and PLCs in the field. It is a part of OT security, with extra weight on remote sites, long communication links and vendor access.
No. Patching still fixes a vulnerability at its source and should happen when the process allows it. Controls in front of the asset change who can reach a vulnerable device and which commands it accepts, so it stays protected until the next maintenance window instead of being exposed until then.