OT Security: Why Critical Infrastructure Is Under Siege and How Security Professionals Respond

In April 2025, attackers took over the control system of a small dam in Western Norway and opened a valve for four hours. The entry point was not a sophisticated zero-day exploit. It had weak credentials on an internet-connected control panel. The incident caused no injuries. It proved a point that security professionals governing converged IT and OT environments need to internalize: the consequences of a compromised operational technology system are not measured in data loss. They are measured in physical disruption, equipment damage, and, in some scenarios, human safety.

The threat is growing faster than most security programs are adapting to it. Dragos tracked 119 ransomware groups targeting industrial organizations in 2025, a 64 percent increase year-over-year, collectively affecting 3,300 organizations. IBM X-Force identified 670 vulnerabilities in OT environments in just the first half of 2025, with nearly half rated critical or high severity. State-sponsored actors are no longer mapping networks for future exploitation as a contingency.
 
Groups linked to Russia, China, and Iran have been observed conducting sustained campaigns specifically designed to understand what operational conditions could trigger process shutdowns in US and European critical infrastructure. If you are preparing for CISSP or CCSP, OT security appears in both certifications and is tested at a governance and architecture level that many professionals have not formally studied.
 
So, if you are managing security programs that include or are adjacent to OT environments, this guide gives you the risk picture, the architectural framework, and the governance controls that turn an unfamiliar attack surface into a managed one.

What Makes OT Security Fundamentally Different From IT Security

The security principles that govern IT environments do not transfer cleanly to OT environments because the foundational priorities are reversed. Understanding that reversal is the prerequisite for governing OT security effectively.

In IT security, the CIA triad prioritizes Confidentiality first, then Integrity, then Availability. A data breach is the failure mode most IT controls are designed to prevent. In OT security, Availability is the primary priority. A power generation system that goes offline to prevent a data breach has failed at its core function. A water treatment plant that shuts down its control systems during an investigation has created a public safety problem that the security incident itself may not have caused.

The specific characteristics that make OT environments structurally different from IT environments include:

1. Legacy system lifecycles are measured in decades, not years. IT hardware is typically refreshed every three to five years. OT equipment, including programmable logic controllers, SCADA servers, and field sensors, commonly operates for 15 to 25 years. Security patches rarely exist for systems that old, and when they do, applying them often requires taking production systems offline during scheduled maintenance windows rather than on the security team's timeline.
2. Proprietary protocols are not designed for security. OT systems communicate using industrial protocols, including Modbus, DNP3, EtherNet/IP, and PROFINET, which were designed for reliability and interoperability in isolated environments, not for authenticated and encrypted communication across internet-connected networks. Most do not natively support encryption or authentication.
3. Physical consequences are the primary risk. A ransomware attack on an IT system produces data loss and business disruption. A ransomware attack on an OT system controlling a pipeline pressure regulation system or a chemical manufacturing process can produce equipment damage, environmental incidents, and human safety risks. The consequence model changes the risk calculus for every treatment decision.
4. Air-gapped or semi-isolated network architecture. OT environments were historically separated from corporate IT networks by design. That separation is eroding rapidly as business efficiency demands drive connectivity, but the security architecture still reflects the isolated origins of most OT systems.

The Current OT Threat Landscape

The OT threat landscape in 2025 is characterized by three distinct attacker categories operating simultaneously with increasing sophistication.

Ransomware groups have made industrial organizations a primary target because the availability-first priority of OT environments creates maximum payment pressure. Manufacturing accounted for more than two-thirds of all ransomware victims in 2025, according to Dragos data. Attackers have learned that a production line shutdown costs significantly more per hour than a corporate IT outage, which makes industrial organizations willing to pay faster and pay more.

State-sponsored threat actors are pursuing a longer-term and more strategically significant objective. CSO Online's analysis of Dragos intelligence confirms that groups including Kamacite spent four months in 2025 systematically scanning specific US industrial control device types in sequence, mapping entire control loops rather than probing for isolated vulnerabilities. Their partner group Electrum struck Polish distributed energy resources in December 2025. A third group, Voltzite (linked to China's Volt Typhoon campaign), was observed manipulating engineering workstations inside US energy and pipeline networks to determine what operational conditions could trigger process shutdowns. This is not opportunistic cybercrime. It is pre-positioned capability development for potential use in geopolitical conflict.

Hacktivist groups represent a third and growing threat category. Multiple groups, including Z-Pentest, Dark Engine, and Sector 16, actively targeted industrial control systems and SCADA HMI interfaces in 2025, driven by geopolitical motivations tied to ongoing international conflicts.

What all three categories have in common is that they consistently exploit the same entry points: exposed remote access systems, default or weak credentials on internet-connected control panels, unpatched vulnerabilities in OT software, and inadequate segmentation between IT and OT networks.

The Purdue Model: OT Network Architecture and Where Security Controls Fit

The Purdue Model for Industrial Control System architecture is the foundational reference framework for understanding how OT networks are structured. It predates modern cybersecurity concerns, but it remains the most widely referenced organizational model for understanding where security controls apply in industrial environments.

Level 0 and 1: Field Devices and Control Systems

Level 0 encompasses the physical process itself: sensors, actuators, motors, valves, and the physical equipment that performs industrial operations. Level 1 contains the intelligent field devices that directly control those physical processes, including programmable logic controllers and remote terminal units.

Security at these levels is primarily physical. Devices at Level 0 and 1 typically have no network connectivity in traditionally segmented environments and limited or no capacity for authentication, encryption, or software updates. Security controls focus on physical access restrictions, tamper-evident enclosures, and ensuring these devices are only reachable through authorized Level 2 interfaces.

Level 2: Supervisory Control (SCADA and HMI)

Level 2 contains the supervisory control and data acquisition systems and human-machine interfaces that operators use to monitor and control the processes running at Levels 0 and 1. This is the level where operators visualize process data, send commands to field devices, and manage alarms.

Level 2 is the highest-value OT target because it provides the most direct path to operational disruption. An attacker who compromises a SCADA server or HMI at Level 2 can potentially modify setpoints, disable alarms, issue unauthorized commands to field devices, and cause physical process disruption without touching the field devices directly.

Level 3: Manufacturing Operations Management

Level 3 contains the manufacturing execution systems, historian databases, and process optimization applications that manage production workflows and store operational data. This level is the primary boundary between pure OT operations and the IT-adjacent systems that support them.

Security at Level 3 requires active network monitoring because this level is where lateral movement from an IT network compromise most commonly reaches OT operations. Anomaly detection at Level 3 provides early warning of unauthorized access attempts before they reach the more operationally sensitive Levels 1 and 2.

Level 4 and 5: Enterprise Network and IT/OT DMZ

Levels 4 and 5 represent the enterprise IT network and the demilitarized zone that separates it from the OT network. The IT/OT DMZ is the most security-critical architectural component in a converged IT/OT environment because it is where the separation between enterprise risk and operational risk is enforced.

A properly designed IT/OT DMZ uses unidirectional security gateways or data diodes to allow operational data to flow from OT to IT for business intelligence purposes while preventing any communication path from IT systems into the OT network. A bidirectional firewall at this boundary is less secure because it creates a path that a compromised IT system can use to reach OT assets.

SCADA Security: The Highest-Value OT Target

SCADA systems represent the most frequently targeted component of OT infrastructure because they combine high operational impact with the connectivity characteristics that enable remote exploitation. As industrial facilities have adopted remote monitoring and cloud-connected SCADA capabilities, systems that were originally designed for isolated network operation are now accessible through internet-connected pathways that their original security architecture was never designed to protect.

The attack vectors most consistently exploited against SCADA systems include:

• Default and hardcoded credentials. Many SCADA software packages ship with default administrative credentials that are documented in vendor manuals. Attackers use these credentials against internet-accessible SCADA interfaces with high success rates because credential rotation in OT environments is operationally difficult.
• Unpatched software vulnerabilities. SCADA software vendors release patches, but applying them requires taking supervisory systems offline during maintenance windows. Many organizations defer patches indefinitely because the operational cost of a planned outage exceeds the perceived likelihood of exploitation. CISA regularly publishes advisories about actively exploited SCADA vulnerabilities that organizations have not patched.
• Remote access tools without adequate controls. The Florida water plant incident in 2021 involved TeamViewer, a remote access tool deployed directly on a computer with access to SCADA controls without adequate authentication requirements. Incidents since then have repeatedly featured similar misconfigurations: remote access tools providing direct SCADA access with insufficient credentials and session controls.
• Engineering workstation compromise. Engineering workstations at Level 2 and 3 that are used to program and configure PLCs and SCADA systems are high-value lateral movement targets. A compromised engineering workstation provides authenticated access to configure control systems in ways that operational staff and monitoring tools may not immediately detect.

OT Network Segmentation and the IT/OT DMZ

Segmentation is the single most effective OT security control available because it limits what an attacker can reach, regardless of the age of the systems they are targeting. The specific segmentation mechanisms available for OT environments range in security strength and operational impact:

• Air gaps: Complete physical network separation between IT and OT. The theoretically strongest segmentation approach, but increasingly impractical as OT environments require data connectivity for remote monitoring, predictive maintenance, and business integration. Air-gapped systems are not immune to compromise: the Stuxnet attack against Iranian nuclear centrifuges demonstrated that air-gapped OT systems can be compromised through physical media and supply chain access.
• Unidirectional security gateways: Hardware-enforced one-way data flow from OT to IT. Data from operational systems can be transmitted to enterprise networks for monitoring and analytics, but no communication path exists in the other direction. This is the strongest segmentation option for environments that require data visibility without bidirectional connectivity.
• Data diodes: Similar to unidirectional gateways but implemented at a lower hardware level. Used in the highest-criticality environments, including nuclear and defense facilities, where any bidirectional communication path is unacceptable.
• IT/OT DMZ with strict access controls: A network zone between IT and OT that hosts specific applications like data historians, remote access jump servers, and patch management systems. Traffic between IT and OT passes through the DMZ with explicit allow rules rather than direct network routing. This is the most common architecture in practice because it balances security with operational connectivity needs.
• Micro-segmentation within OT: Separating OT network zones by criticality and function, ensuring that a compromise at Level 3 cannot directly reach Level 1 control systems without traversing a monitored boundary.

Effective OT segmentation also requires monitoring at the boundary. The CSPM capabilities that provide continuous configuration assessment for cloud environments have OT equivalents in passive network monitoring tools that inspect OT protocol traffic for anomalies without requiring active scanning that might disrupt control system operations.

If you are preparing for CCSP and want to understand how cloud connectivity is changing OT security architecture, the free CCSP Cloud Security Mini MasterClass from Destination Certification walks through cloud security architecture concepts, including how cloud connectivity affects OT risk at no cost.

OT Security Frameworks: NIST SP 800-82 and ISA/IEC 62443

Two frameworks provide the most directly applicable guidance for OT security governance across the environments where CISSP and CCSP professionals typically work.

NIST SP 800-82 - Guide to Operational Technology Security: NIST's primary OT security publication provides guidance for securing industrial control systems, including SCADA systems, distributed control systems, and programmable logic controllers. It addresses OT-specific risk management, network architecture, and security controls while acknowledging the operational constraints that distinguish OT from standard IT environments.
 
For CISSP professionals, NIST SP 800-82 maps directly to Domain 3 security architecture and Domain 7 security operations content. The security control frameworks guide addresses how NIST frameworks apply across different security domains, including OT.

ISA/IEC 62443 - Industrial Automation and Control Systems Security: The ISA/IEC 62443 series is the primary international standard for OT and ICS security. It introduces the concept of security zones and conduits, which provide a structured approach to segmenting industrial networks by criticality, and security levels, which define the degree of protection required for each zone based on the threat environment and consequence of compromise.
 
The standard addresses the responsibilities of asset owners, system integrators, and component suppliers, making it particularly relevant for environments where OT security governance spans multiple organizational boundaries.

OT Incident Response: Why It Differs From IT Incident Response

When an IT system is compromised, the standard incident response instinct is to isolate it immediately. Containment prevents lateral movement. In OT environments, isolation may not be an option. A compromised PLC controlling a continuous chemical process cannot be simply disconnected without understanding the physical consequences that disconnection will cause.
 
A SCADA server managing a power distribution network cannot be taken offline for forensic imaging without potentially affecting the electricity supply to the area it serves.

OT incident response requires a governance framework that specifically addresses the availability constraint. The key differences from standard IT incident response include:

• Preservation of operational continuity during investigation: OT incident response teams must coordinate with operations engineering to understand which systems can be isolated, which must remain operational, and what compensating controls can maintain operational safety while the investigation proceeds.
• IT and OT team coordination: IT security teams typically lead incident response. OT engineers understand the systems being investigated. Neither team alone has the full picture. Effective OT incident response requires a pre-established coordination protocol that brings both teams into the response under a unified command structure.
• Forensic evidence collection without system disruption: Standard forensic imaging requires taking systems offline. OT forensic approaches rely on passive traffic capture, log collection from adjacent systems, and configuration snapshots that do not require interrupting control system operations.
• Recovery sequencing based on operational priority: OT recovery follows operational criticality rather than IT system dependency. The systems that directly control the physical process are restored first. Supporting the IT infrastructure that provides data visibility and remote access is restored afterward.
• Regulatory notification requirements: OT incidents in critical infrastructure sectors trigger specific regulatory notification obligations under CISA reporting requirements, sector-specific regulations, and, in some cases, international obligations. These governance decisions belong to the security manager, not the technical response team.

How CISSP and CCSP Test OT Security

Neither certification tests OT at the protocol or engineering level. Both test whether you understand OT risk from a governance and architecture perspective: how OT network architecture differs from IT, what the Purdue model establishes, why standard IT controls cannot be directly applied, what frameworks govern OT security, and how incident response must adapt to the availability-first constraint.

For CISSP, the exam tests OT security as part of the broader security architecture and network security domains. Expect scenario-based questions about appropriate security controls for industrial environments, the correct network architecture for IT/OT separation, and the governance considerations for OT incident response. For CCSP, OT appears primarily in the context of cloud-connected industrial systems and the security controls that maintain cloud security posture when OT systems are part of the deployment.

For a view of how OT security connects to the adjacent IoT attack surface that many professionals govern simultaneously, the IoT security guide provides a companion framework for managing connected device risks alongside traditional OT environments.

Frequently Asked Questions 

The Attack Surface Has Moved Beyond IT. Make Sure Your Preparation Has Too. Start with Destination Certification

You now understand what makes OT environments structurally different from IT, what the current threat actors are doing against industrial targets, how the Purdue model organizes OT network architecture, what SCADA systems face as the highest-value OT target, and how incident response must adapt when availability cannot be sacrificed for containment. The professionals who govern OT risk effectively are not the ones who simply apply IT security principles to industrial environments. They are the ones who understand the governance framework that accounts for availability constraints, legacy system realities, and physical consequence risk. That is what CISSP and CCSP build.

The Destination Certification CISSP MasterClass develops the security architecture and network security governance thinking that governs OT environments at the program level. If the Purdue model, ICS network architecture, and OT incident response governance are where you want to deepen your expertise, CISSP builds the foundational framework on which those decisions rest.

If your focus is on cloud-connected OT and the security architecture that governs remote monitoring, cloud SCADA platforms, and hybrid industrial environments, the Destination Certification CCSP MasterClass develops the cloud security governance and operations competencies that close those gaps. Both MasterClasses use adaptive learning systems that identify your specific knowledge gaps and adjust your study plan around your schedule.

Start with the free CCSP Cloud Security Mini MasterClass from Destination Certification to understand how cloud connectivity is reshaping OT security architecture and what CCSP professionals need to know about governing cloud-connected industrial environments, before committing to a full preparation program.

OT security failures are not measured in data loss. They are measured in physical disruption. Destination Certification builds the expertise to govern both.