Protect the systems that run physical processes: SCADA, PLCs, industrial protocols and the networks behind energy, water, manufacturing and buildings, where safety comes before everything.
Estimated time: 15–30 months · At about 10 hours a week.
Learning path
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Explain how OT differs from IT and why it matters for security.
Identify ICS components and protocols in a network.
Apply the Purdue model to a plant.
Hands-on projects and labs
Build a small simulated ICS with an open-source PLC simulator and an HMI, and capture its Modbus traffic.
Map a sample plant network onto the Purdue model and mark the zones.
Done when you can…
Read an industrial network capture and describe what the devices are doing.
Explain three real OT incidents and the attacker's path in each.
Beginner
OT versus IT
OT prioritises safety and availability over confidentiality, runs for decades, and cannot simply be patched or rebooted. Everything in OT security follows from these differences.
Plant engineers own safety and uptime. Learn their constraints, change windows and language before proposing any control. Trust is earned slowly in OT.
Deploy Malcolm against a simulated ICS and build an inventory from passive capture.
Design zones, conduits and an industrial DMZ for a sample plant per IEC 62443.
Set up brokered remote access to the lab PLC with recording.
Done when you can…
Produce an IEC 62443 zone and conduit design for a real or simulated plant.
Detect an attack on a simulated ICS with passive monitoring.
Intermediate
IEC 62443
The main OT security standard: zones, conduits, security levels and requirements for owners, integrators and vendors. Learn its structure and how to apply it.
Vendors and engineers need remote access to plants. Make it brokered, authenticated, time-limited and recorded, never a direct VPN into the control network.
Monitor OT traffic passively for new devices, protocol anomalies and known attack behaviours. Tune detection with the engineers who know what normal looks like.
Run an OT incident tabletop with plant engineers, including manual operation.
Assess a simulated plant and write a report with prioritised, plant-realistic fixes.
Threat model a process using ATT&CK for ICS and identify the consequences that matter most.
Done when you can…
Lead an OT incident response exercise that keeps safety first.
Produce an OT assessment that engineers accept and act on.
Advanced
OT incident response
Response must preserve safety and process continuity. Plan with engineers, know when to isolate, and have manual operation and recovery procedures ready.
Assess plants with passive techniques, configuration review and careful, agreed testing. Never run active tools on production OT without engineering sign-off.
NIS2, sector rules for energy, water and transport, and national critical infrastructure schemes set OT security duties. Know which apply to your sites.
Write an OT security programme plan for a multi-site organisation.
Design a site maturity scorecard and roadmap.
Done when you can…
Lead OT security across an organisation with measured site maturity.
Be trusted by both security and operations leadership.
Expert
Building an OT security programme
Cover many sites with different vendors, ages and owners. Standardise what you can, set a maturity target per site, and fund it with the operations budget holders.
Track inventory coverage, segmentation status, remote access control, monitoring coverage and time to respond, per site. Report to operations leadership.
Operational technology controls physical processes: power grids, water treatment, factories, pipelines and building systems. It was built for reliability and safety over decades, often without security, and it is now connected to corporate networks and the internet.
OT security adapts IT security to this world: understanding industrial protocols and controllers, segmenting networks, monitoring passively, patching when the plant allows, and responding to incidents without causing an outage or a safety event. It needs engineering empathy as much as security skill.
Why it matters
Attacks on infrastructure can cause physical harm and large-scale disruption, and regulators increasingly require OT security. There are far fewer OT security specialists than roles, and the skills are hard to pick up without deliberate study.
Typical job roles
EntryOT security analystMonitors OT networks and handles alerts.
Mid-levelOT security engineerDesigns segmentation and controls for plants.
SeniorICS security architectSets OT security architecture across sites.
LeadHead of OT securityOwns the OT security programme.
Prerequisites
Network security fundamentals.
Some understanding of how industrial processes and control systems work.
Security operations basics.
Patience and respect for safety and uptime constraints.
MITRE ATT&CK for ICSThe tactics and techniques attackers use against industrial control systems.
MITRE EMB3DA threat model for embedded devices, with device properties, threats and mitigations.
NIS2 DirectiveThe EU law that sets security and incident reporting duties for essential and important organisations.
NIST Cybersecurity Framework (CSF) 2.0A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.