Cybersecurity Best Practices for OT and SCADA Networks

The convergence of Information Technology (IT) and Operational Technology (OT) has created new attack surfaces that traditional IT security tools were never designed to handle. SCADA systems, PLCs and industrial controllers were built for isolated networks, in an era when physical separation was the security model. Connecting them to enterprise IT infrastructure introduces risks that demand mitigation strategies of a different kind.

The difference is not one of degree. An IT breach costs data; an OT breach can cost a process, a production line, or a person. That inverts the usual priority order: in IT the ranking is confidentiality, integrity, availability. In OT it is availability and safety first, and every control has to respect that inversion, or the people running the plant will bypass it.

Segmentation is still the first line of defence

Network segmentation remains the highest-value control available. A Purdue Model architecture with clear demilitarised zones between the IT and OT layers prevents lateral movement: an attacker who compromises a workstation in the business network should not find a routable path to a controller. Industrial firewalls and unidirectional gateways let data flow from OT to IT for monitoring, while making the reverse path either tightly filtered or physically impossible.

The failure mode here is predictable. Segmentation gets designed correctly and then eroded in service: a temporary vendor VPN nobody removed, an engineering laptop dual-homed onto both networks, a jump host everyone shares one password for. The drawing and the wire diverge within eighteen months unless someone owns the difference.

Segmentation often means physically separate runs rather than shared switching, and on plant-scale sites those runs are long. Fibre is the usual answer for isolated OT links between buildings, and the link has to be engineered rather than assumed. Connector and splice losses accumulate quickly on a long multi-building path.

To confirm an isolated fibre segment closes with adequate margin before installation, use our free Fiber Link Budget Calculator

IEC 62443 as a working framework

The IEC 62443 standard provides a comprehensive framework for securing industrial automation and control systems. Its practical contribution is the vocabulary: zones, conduits and security levels. Instead of arguing about whether the plant is "secure", you divide it into zones with defined trust boundaries, define the conduits that connect them, assign a target security level to each, and then measure the gap between target and actual.

That structure makes an OT security programme auditable rather than aspirational. Compliance is increasingly required in critical infrastructure sectors, and the requirements that actually apply depend on your sector regulator and the current edition of the standard. Verify both rather than working from a summary.

Divide the plant into zones by function and consequence, not by physical location
Document every conduit between zones, including the ones nobody approved
Assign a target security level per zone based on consequence of compromise
Assess the actual level against the target and treat the gap as a work list
Re-assess after every significant change to the process or the network

Monitoring OT traffic is not monitoring IT traffic

Continuous monitoring and anomaly detection are essential precisely because OT networks have unique traffic patterns, and that uniqueness is an advantage. The same controllers talk to the same HMIs, in the same sequence, at broadly the same rate, all day. A deviation is genuinely anomalous in a way that it never is on a user LAN.

Specialised OT intrusion detection systems can identify protocol anomalies in Modbus, DNP3 and BACnet traffic that generic IT tools do not parse at all. Establishing a baseline for each controller and alerting on deviation enables early detection: an unexpected function code, a write to a register that is normally read-only, a new engineering workstation appearing on the segment.

Monitoring must be passive. Active scanning tools that are routine in IT can knock a legacy PLC offline, because the device's network stack was never built to absorb an aggressive port scan. Use network taps or SPAN ports and read the traffic; do not probe the controllers.

Patching, credentials and the constraints that are real

Patching an OT asset is not an IT operation with an OT flavour. Controllers cannot be rebooted during production, vendor validation may lag a public disclosure by months, and unvalidated firmware on a safety-related device may invalidate its certification. The honest answer is compensating controls: if you cannot patch, isolate harder, monitor closer, and document the accepted risk.

Maintain an accurate asset inventory, because you cannot protect controllers you do not know exist
Remove shared and default credentials, especially on HMIs and engineering workstations
Enforce multi-factor authentication on every remote access path into the OT network
Control removable media; USB remains a live infection vector on air-gapped plants
Keep offline, tested backups of controller logic and HMI configuration, not just of servers
Where patching is impossible, record the compensating control and the risk acceptance in writing

Incident response under operational constraints

Incident response plans must account for OT-specific constraints. The IT reflex is to isolate the host, take an image and rebuild, and any of those can trip a process into an unsafe state. Response procedures have to balance security action against operational safety, and that balance cannot be struck during the incident. It has to be agreed in advance, with process engineers and facility operators in the room alongside the cybersecurity team.

The plan should name who has authority to stop a process, what the safe shutdown sequence is for each zone, and how the plant runs in manual if the control system is untrusted. Then it should be exercised. A tabletop that includes the operations shift supervisor will surface more real gaps in two hours than a year of policy writing.

OT security is not a product you install. It is segmentation you maintain, an inventory you keep current, monitoring you actually read, and a response plan that the people running the plant have rehearsed. Start with the asset inventory and the network diagram. Until those two documents are accurate, every other control is being applied to a system you cannot see.