SECNET / FIELD GUIDE · Operations

OT security: protect the process before probing devices

OT security must account for physical processes, safety, availability and engineering constraints. Use the final NIST SP 800-82 Rev. 3 as a reference; a later draft is not a final replacement. IT scanning assumptions cannot be transferred blindly to controllers and safety-related systems.

SecNet learning series · 1.0 · Source check: 2026-10-11

Original SecNet educational content. Examples are fictional; this is not a publication or endorsement by the referenced organizations.

An industrial plant and office network are separated by a controlled gateway and safety boundary.
Original AI-assisted educational illustration; not an incident photograph or technical architecture.
SECNET / VISUAL LAB · OT / INDUSTRIAL

Factory · IT / OT zones and conduits

See boundary controls around a factory’s operational network.

INTERACTIVE
Safety system · separate risk assessment · no control commands in this flow
PLC / production cellCell boundaryOperations · HMIOT boundaryIndustrial DMZ · broker
01 / 05 · PLC / production cell

OT data reaches a monitored DMZ service. Enterprise applications consume brokered data; no direct IT-to-PLC session.

Example architecture, not a deployment specification. Assess safety-system separation and availability with plant engineers; prefer passive observation during assessment.

Sources · 2026-10-11NIST SP 800-82r3 · §§5.2, 5.4.1 ↗
Show process diagram
Process → Passive map → Boundaries → Safe change → Restore
A summary of the workflow; detailed steps follow below.

How to plan and execute

  1. Form a joint operations, engineering, safety and security team. Identify critical process states and agree who may stop an activity when plant behavior changes.
  2. Build an asset and dependency map from engineering records and passive observation. Record controller/firmware versions, unsupported systems and the confidence of the inventory.
  3. Define process zones and constrained communication paths. Separate vendor remote access with approval, time limits, logging and a recovery method suitable for operations.
  4. Assess proposed tests with engineering and suppliers in a representative lab first. Prefer passive evidence; active tests need explicit validation, a maintenance window and a stop/rollback plan.
  5. Treat patching as controlled engineering change. Where a patch cannot safely be applied, document compensating controls, residual risk, review date and accountable acceptance.
  6. Exercise recovery of engineering workstations, logic/configuration backups and approved spare devices. Coordinate cyber response with plant emergency procedures and physical safety.

Tools & work records

  • Engineering inventory and passive telemetry — start with existing records and permitted mirror/TAP observations; validate protocol coverage.
  • Wireshark — protocol evidence where approved; packet capture access and retention still need control.
  • Lab and restore worksheets — record representative hardware, vendor approval, stop thresholds and demonstrated recovery.

What reports are produced?

  • Process-critical asset map and safety/change constraints.
  • Zone/communication review and remote-access control record.
  • Compensating-control register and tested restoration plan.
FICTIONAL WORKED EXAMPLE

Connect the decision to evidence

Fictional plant: an older controller has a known weakness but no validated patch. The team does not launch an IT scanner at it. They review vendor guidance, narrow reachable services, restrict remote maintenance and test a representative spare in the lab. The risk record names the process owner and next review, while the restore exercise proves that backed-up logic can be recovered.

Closure check

  • Operations and safety owners approve the plan?
  • Active tests validated in a representative lab first?
  • Logic/configuration restoration demonstrated?
Download report workpaper (.md) ↓

Official sources

Use these sources for criteria, tools and regulations; verify applicability and version for the actual assessment.