OT & ICS security
Operational technology (OT) runs physical processes: PLCs, SCADA, DCS and building systems. NIST SP 800-82 Rev. 3, published September 2023, explains how to secure OT while accounting for performance, reliability and safety, and the ISA/IEC 62443 series sets requirements for industrial automation and control systems, split by role: asset owners, integrators and product suppliers.
What we do
- OT asset discovery and inventory
- Segmentation design between IT, OT and safety zones
- Passive network monitoring sensors
- Vulnerability and exposure prioritisation for plant devices
- Secure third-party remote access
- Alerts integrated with SIEM and SOAR
- IEC 62443 gap assessment
- OT incident response and tabletop exercises
Monitoring tools learn the plant without touching it. Claroty offers asset inventory, exposure management, segmentation and threat detection for cyber-physical systems; Nozomi Networks provides Guardian network sensors for OT and IoT inventory; Dragos focuses on OT visibility, vulnerability management, detection and threat intelligence; Microsoft Defender for IoT does agentless network monitoring with sensors that can run air-gapped.
Our approach: inventory first, then segmentation, then monitoring, with changes planned around production windows and safety. Experience with these tools, not a partnership. Connects to our industrial IoT and cybersecurity work.
Leading platforms we work with
- Claroty
- Nozomi Networks
- Dragos
- Microsoft Defender for IoT
- ISA/IEC 62443
- NIST SP 800-82 Rev. 3
Platforms and practices
- Purdue-style segmentation
- Passive OT network monitoring
- Secure remote access for vendors
- OT asset inventory
- OT incident response planning
References
- Claroty: platform
- Nozomi Networks: platform
- Dragos
- Microsoft Learn: Defender for IoT overview
- ISA: ISA/IEC 62443 series of standards
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use OT & ICS security for clients
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhat is the difference between IT and OT security?
OT runs physical processes, such as PLCs, SCADA and building systems, where performance, reliability and safety come first. NIST SP 800-82 Rev. 3 explains how to secure OT with those constraints in mind.
Where do you start in a plant?
Inventory first, then segmentation, then monitoring, with changes planned around production windows and safety. You cannot defend what you cannot list.
Will monitoring disturb our controllers?
Passive monitoring learns the plant from network traffic without touching the devices. We avoid active scanning of fragile controllers unless it is agreed with the plant.
What is ISA/IEC 62443?
A series of requirements for industrial automation and control systems, split by role: asset owners, integrators and product suppliers. We run gap assessments against it.
How do you handle vendor remote access?
Through secure, logged, time-limited remote access with named accounts, instead of standing vendor VPNs, and segmented from the control network.
Which OT monitoring tools do you work with?
Claroty, Nozomi Networks, Dragos and Microsoft Defender for IoT. This is experience with these tools, not a partnership, and we choose by your plant.