OT/ICS Security
SCADA, PLC security, Purdue model, ICS-specific threats, IT/OT convergence, IEC 62443.
What is OT/ICS Security?
Operational Technology (OT) and Industrial Control Systems (ICS) security protects the systems that control physical processes — power grids, water treatment plants, manufacturing lines, oil refineries, and transportation networks. Unlike IT systems where confidentiality is paramount, OT environments prioritize availability and safety: a compromised programmable logic controller (PLC) or SCADA system can cause physical damage, environmental disasters, or loss of life.
The Purdue Model (ISA-95) provides the reference architecture for OT network segmentation, organizing systems into hierarchical levels from Level 0 (physical processes and sensors) through Level 5 (enterprise network). The convergence of IT and OT networks — driven by digital transformation initiatives — has dramatically expanded the attack surface, connecting previously air-gapped industrial systems to corporate networks and the internet.
High-profile attacks like Stuxnet (2010), the Ukraine power grid attacks (2015-2016), TRITON/TRISIS targeting safety instrumented systems (2017), and the Oldsmar water treatment hack (2021) have demonstrated that nation-states and sophisticated threat actors actively target critical infrastructure. IEC 62443 has emerged as the primary international standard for industrial cybersecurity, providing a comprehensive framework for securing industrial automation and control systems.
Why it matters
OT/ICS systems control critical infrastructure that societies depend on for electricity, water, transportation, and manufacturing. A successful attack on these systems can have consequences far beyond data loss — including physical destruction and threats to human safety.
OT/ICS security applies cybersecurity principles to environments with fundamentally different constraints than IT — where patching may require plant shutdowns, legacy systems run for decades, and safety always trumps security. It bridges the gap between cybersecurity expertise and industrial engineering knowledge.
Build, Connect & Operate
Build and run the systems — apps, cloud, data, networks, OT, AI infra, supply chain, quantum engineering.
Other domains in this layer
Key topics
People shaping this field
Researchers and practitioners worth following in this space.
CEO of Dragos, ICS/OT security expert, SANS instructor
Industrial cybersecurity expert, Stuxnet analyst
Founder of S4 Events, ICS security pioneer
Curated resources
Authoritative sources we ground OT/ICS Security questions in — frameworks, research, guides, and tools.
NIST SP 800-82 Rev. 3 — Guide to OT Security
Updated terminology from ICS to OT. Covers Purdue Model, network segmentation, patching challenges in OT environments. The primary OT security reference.
IEC 62443 — Industrial Automation Security
Multi-part standard covering security levels, zones and conduits, component requirements. International standard for industrial cybersecurity.
Dragos Year in Review
Annual OT/ICS threat landscape report. Tracks threat groups (Chernovite, Bentonite, etc.) targeting industrial systems. Original research, not marketing.
CISA Industrial Control Systems Advisories
Authoritative feed of ICS-CERT advisories covering vulnerabilities in PLCs, HMIs, SCADA platforms, and OT vendors. The primary source for tracking active threats to industrial systems.
SANS Five ICS Cybersecurity Critical Controls
Practical, defender-focused control framework: ICS Incident Response, Defensible Architecture, ICS Network Visibility, Secure Remote Access, Risk-Based Vulnerability Management. The de-facto starter list.
Roles where this matters
Career paths where this domain shows up as core or recommended.
Protect critical infrastructure — power grids, water treatment, manufacturing. Where cyber meets the physical world.
Senior design role — defines how pillar A components fit together across identity, crypto, network, cloud, and data — and, increasingly, how pillar C bolts into it.
Certifications that signal this domain
Credentials whose blueprint meaningfully covers this domain. Core means centrally covered; also touched means present in the blueprint but not the primary focus.
Core coverage
Azure IoT Developer Specialty
Azure IoT Developer Specialty
Mile2 Certified Digital Forensics Examiner
Mile2 Certified Digital Forensics Examiner
Mile2 Certified Network Forensics Examiner
Mile2 Certified Network Forensics Examiner
Excida IEC 62443 Certified Automation Cybersecurity Expert
Excida IEC 62443 Certified Automation Cybersecurity Expert
Excida IEC 62443 Certified Automation Cybersecurity Specialist
Excida IEC 62443 Certified Automation Cybersecurity Specialist
Dark Vortex Malware Incident and Log Foensics
Dark Vortex Malware Incident and Log Forensics
eLearnSecurity Certified Digital Forensics Professional
eLearnSecurity Certified Digital Forensics Professional
Fortinet Certified Solution Specialist - OT Security
Fortinet Certified Solution Specialist - OT Security
GIAC Battlefield Forensics and Acquisition
GIAC Battlefield Forensics and Acquisition
Global Industrial Cyber Security Professional
IT + engineering overlap for industrial control systems.
GIAC Response and Industrial Defense
Active defense and incident response for ICS environments.
GIAC Experienced Forensics Analyst
GIAC Experienced Forensics Analyst
ISA Certified Automation Specialist
ISA Certified Automation Specialist
TUV Certified OT Security Manager
TUV Certified OT Security Manager
TUV Certified OT Security Practitioner
TUV Certified OT Security Practitioner
TUV Certified OT Security Technical Expert
TUV Certified OT Security Technical Expert
TUV Rheinland Certified Operational Technology Cybersecurity Professional (GERMAN)
TUV Rheinland Certified Operational Technology Cybersecurity Professional (GERMAN)
Browse all certifications → — pick a cert on the interactive map to highlight every domain it covers.
More in Cybersecurity
Test what you know about OT/ICS Security
42 questions available. Beginner to expert questions, scored against the global leaderboard.