OT/ICS Security: Protecting Industry from Cyber Threats

Industrial systems (OT/ICS) were once isolated from the IT network. Those days are over. IT/OT convergence, accelerated by Industry 4.0 and industrial IoT, has created a massive attack surface. The consequences of a compromise are no longer virtual: production shutdowns, physical damage, risks to human safety.

IT/OT Convergence: The Fundamental Problem

IT/OT convergence means industrial production networks are now connected to enterprise networks, and often to the Internet. The reasons are legitimate (remote monitoring, predictive maintenance, optimization) but the risks are considerable:

• Insecure protocols: Modbus, OPC, DNP3 were not designed for hostile environments

• Impossible patching: PLCs and SCADA systems often cannot be updated without production downtime

• Extended lifespan: OT equipment lasts 15-25 years, well beyond software support

• Low visibility: IT security teams often have zero visibility into the OT network

The Purdue Model: Segment to Protect

The Purdue model (ISA-95/IEC 62443) defines 6 segmentation levels for industrial networks:

• Level 0: Physical process (sensors, actuators)

• Level 1: Basic control (PLCs, RTUs)

• Level 2: Supervision (SCADA, HMI)

• Level 3: Site operations (MES, historians)

• Industrial DMZ: Critical buffer zone between IT and OT

• Levels 4-5: Enterprise network and Internet

The key is the industrial DMZ. No direct traffic should flow from IT to OT. All communications go through relay servers in the DMZ, with inspection and logging.

OT Intrusion Detection with Suricata and Zeek

Suricata for Signature-Based Detection

Suricata supports industrial protocol analysis (Modbus, DNP3, ENIP/CIP) with specific rules. It can detect abnormal commands, attempts to modify critical registers, and industrial protocol scans. Deployed at the DMZ level, it provides an effective first line of detection.

Zeek for Behavioral Analysis

Zeek (formerly Bro) excels at creating OT traffic baselines. In an industrial environment, communications are predictable and repetitive. Any deviation (new flow, unusual command, abnormal volume) is an alert signal. Zeek generates structured logs ideal for analysis.

ThreatClaw: Unifying IT and OT Detection

ThreatClaw unifies IT and OT alerts in a single platform, correlating events to detect attacks that cross the IT/OT boundary. Lateral movement starting from a desktop workstation and reaching the SCADA network is detected as a complete attack chain.

Notable OT Attacks

• Stuxnet (2010): first cyber weapon targeting Siemens PLCs. Physical destruction of Iranian centrifuges

• Industroyer (2016): attack on the Ukrainian power grid, blackout for 230,000 people

• TRITON/TRISIS (2017): attack on safety instrumented systems (SIS) at a petrochemical plant. Explosion risk

• Colonial Pipeline (2021): ransomware causing shutdown of the largest US fuel pipeline

Priority Actions

• Implement Purdue segmentation with industrial DMZ

• Deploy a passive detection probe (Suricata/Zeek) on the OT network

• Inventory all OT assets and their vulnerabilities

• Disable unsecured remote access to industrial equipment

• Train OT teams on cyber risks

Discover our industrial security expertise and tailored plans.

FAQ

Can you install antivirus on a PLC?

No. PLCs generally do not run a standard OS. Protection relies on network segmentation, traffic monitoring, and physical and logical access control.

What is the reference standard for OT security?

IEC 62443 is the international reference standard for industrial system security. It covers organizational, architectural, and technical aspects.

How do you monitor an OT network without impacting it?

By using passive probes (port mirroring/SPAN) that observe traffic without injecting packets. Suricata and Zeek work perfectly in passive mode.

Does NIS2 apply to industrial sites?

Yes. Energy, transport, water, and manufacturing sectors are explicitly covered by NIS2 as essential or important entities.