A Beginner's Map of OT and ICS Security
When most people think of cybersecurity, they picture laptops, servers, and stolen passwords. But some of the most important computers in the world control physical things: dams, power grids, water treatment, pipelines, and factories. That world is called OT (operational technology) and ICS (industrial control systems), and it’s where I want to build my career. This post is the map I wish I’d had when I started learning. Some vocabulary OT: hardware and software that monitors or controls physical processes. ICS: the control systems themselves. SCADA: supervisory systems that monitor and control equipment spread over large areas, like a pipeline or a power grid. PLC: programmable logic controller. A rugged little computer that reads sensors and drives motors, valves, and breakers in a loop, for years at a time. HMI: human-machine interface. The screen an operator uses to watch and control the process. Safety instrumented system (SIS): an independent system whose only job is to shut things down safely when something goes dangerously wrong. Why OT is different from IT The priorities are flipped. IT security talks about confidentiality, integrity, and availability, usually in that order. In OT, safety comes first, then availability. A leaked spreadsheet is bad. A chlorine pump running wild or a turbine overspeeding can hurt people. ...