KutupASP Dijital
TROpen NQ
OT

What is the difference between OT security and IT security?

Short answer

IT security usually prioritises confidentiality and data integrity. OT security puts safety and availability first, because an attack or a wrong patch can have physical consequences. OT assets run for many years, patch windows are short, and many protocols lack authentication. Common responses are segmentation, passive monitoring and change management.

October 2, 20263 minKutup · ASP Dijital

Why the priorities flip

In IT systems the usual priority order is confidentiality, integrity and then availability. In OT the order is often reversed: safety first, then availability of the process, then data. A controller that returns a wrong answer can drive a valve to the wrong position, and the consequence is physical.

OT assets also stay in service for years, sometimes after the vendor has stopped supporting them. Patches must fit into scheduled shutdown windows. Real-time control loops can be disturbed by heavy scanning traffic; an aggressive network scan can slow a controller in ways nobody expected.

NIST SP 800-82 Rev. 3 treats these differences as the starting point for OT security guidance.

Worked example: one patch decision

Hypothetical case: the vendor publishes a security patch for a PLC, but the maintenance window is only 8 hours a month. The patch needs 3 restarts of 25 minutes each, which is 3 × 25 = 75 minutes. That is 75 / 480 = 0.156, or about 15.6 % of the 8 × 60 = 480 minute window.

A fast patch is not the only option. One choice is to wait for the next window and tighten segmentation around the PLC in the meantime. Another is to test the patch on a bench setup that mirrors the line before installing it. The right option depends on the process risk, the vendor's support position and what the patch fixes.

Common mistakes

The first mistake is applying the IT patch cycle to OT unchanged. A monthly patch may not fit a controller's shutdown window. Timing and method should be agreed with the process owners.

The second mistake is relying on an air gap. Even without a network link, USB media, remote maintenance access and laptops that move between networks can create paths. Without an asset inventory, nobody knows which paths are open.

The third mistake is running an untested active scan on a production network. Active scanning can disturb old PLCs and HMIs. Start with passive monitoring, and validate any active scan in a test environment first.

Follow-up questions

Should antivirus and patching run on every OT machine?

They should be evaluated, but not with an IT habit. Software should be installed only after the equipment vendor and the process owner approve it. Some legacy controllers may not support such tools at all, so other controls matter more there.

Is a firewall enough for OT?

Not on its own. A firewall enforces rules at zone boundaries, but unauthorised access inside a zone, misconfiguration and poorly controlled maintenance channels still carry risk. Segmentation, monitoring and change management belong together.

Sources

Example numbers are hypothetical, not measured field results.

Read the full guide.

Full library

Related questions

All questions
What is a 4-20 mA signal, and why does it start at 4 mA, not 0?How is a 4-20 mA signal scaled to engineering units?How often should an instrument be calibrated?What do the P, I and D terms do in a PID controller?Why does a PID loop oscillate?What is a PLC scan time, and how is it measured?