Operational Technology (OT)

OT systems must execute control loops with microsecond precision. Unlike IT systems that can tolerate latency, a delayed command in an OT environment can cause physical destruction. Deterministic performance ensures that a specific input always produces a predictable output within a strictly bounded timeframe, a critical requirement for closed-loop process control and high-speed protection relays in electrical substations.

The fundamental distinction of OT is its ability to sense and actuate the physical world. This involves a direct chain from sensors (temperature, pressure, voltage) to Programmable Logic Controllers (PLCs) and finally to actuators (valves, motors, breakers). This cyber-physical link means that software failures translate immediately into kinetic consequences, making safety the paramount concern over confidentiality.

Industrial assets often operate for 15 to 30 years or more, far exceeding typical IT refresh cycles of 3-5 years. This longevity creates a heterogeneous environment where modern IEC 61850 compliant devices coexist with legacy serial-based protocols like Modbus RTU. Patch management is exceptionally difficult, as taking a critical controller offline for an update may require halting a multi-million dollar production line.

In OT, the CIA triad is inverted to AIC: Availability, Integrity, then Confidentiality. Unscheduled downtime is often unacceptable, measured in millions of dollars per hour. This drives architectural choices like redundant ring topologies and uninterruptible power supplies. Security controls, such as active scanning, are often avoided because they risk crashing fragile legacy firmware and causing a denial of service.

Unlike the standardized TCP/IP stack of IT, OT relies on a multitude of specialized industrial protocols optimized for determinism and telemetry. These include DNP3 for utility telemetry, EtherNet/IP for manufacturing, and Profinet for high-speed motion control. These protocols lack native encryption and authentication, as they were designed for isolated, trusted networks, creating a massive attack surface when connected to enterprise systems.

OT networks are structured according to the Purdue Enterprise Reference Architecture (PERA) , which segments the environment into distinct levels (Level 0-5). This ranges from the physical process (Level 0) up to the enterprise IT network (Level 5). The critical boundary is the Industrial Demilitarized Zone (IDMZ) between Levels 3 and 4, which strictly controls data flow to prevent IT threats from cascading down to physical controllers.

An umbrella term encompassing all hardware and software used to automate industrial processes. ICS includes SCADA, Distributed Control Systems (DCS), and PLCs working together to maintain safe and efficient operations.

• DCS provides localized, high-speed process control
• PLCs execute discrete logic for machinery
• Safety Instrumented Systems (SIS) provide independent protection layers
• Field devices include sensors, actuators, and transmitters

Distributed Network Protocol 3 is an open, robust communication standard designed for reliable data acquisition between control center masters and remote outstations. It supports time-stamped events, unsolicited reporting, and secure authentication.

• Transport layer supports TCP and UDP
• Link layer provides frame integrity via CRC
• Application layer handles data object formatting
• Widely deployed in North American electric utilities

A widely adopted master-slave protocol that encapsulates the original Modbus serial frame within a TCP/IP packet. Its simplicity and openness make it ubiquitous but also a prime target for cyber attacks.

• Function codes define read/write operations
• No built-in authentication or encryption
• Used extensively in building automation and manufacturing
• Deep packet inspection can validate function code legitimacy

An international standard for substation automation that defines abstract data models and high-speed peer-to-peer communication. It replaces hardwired copper connections with Ethernet-based logical interfaces.

• GOOSE messaging for protection tripping (< 4ms)
• Sampled Values for merging unit current/voltage streams
• Substation Configuration Language (SCL) for engineering
• Enables interoperability between multi-vendor IEDs

Open Platform Communications Unified Architecture provides a secure, platform-independent framework for industrial interoperability. It moves beyond simple data transport to offer semantic modeling and discovery.

• Supports client-server and pub-sub patterns
• Built-in encryption, authentication, and auditing
• Address space model represents real-world objects
• Bridges IT/OT gap with structured information models