IT security is usually explained through the CIA triad: confidentiality, integrity, and availability, roughly in that order of priority. A bank or a hospital records system worries first about data being stolen, then about it being altered, then about it being unavailable.
How Does the CIA Triad Change in Industrial Systems?
Industrial control systems turn that order around. In a refinery, power station or water plant, availability comes first, because stopping a process can cost millions per day and create physical hazards. Integrity comes next, because a manipulated setpoint or sensor reading can damage equipment or harm people. Confidentiality comes last: most process data is of little value to an outsider. Above all three sits safety, which is why OT engineers often describe their priorities as safety, availability, integrity, confidentiality.
That inversion changes almost every security decision. An IT team may isolate an infected server immediately. An OT team must first ask whether isolating a human-machine interface will leave operators blind to a running process. An IT team may scan its network weekly. An OT team knows that an aggressive scan can crash an older programmable logic controller. This is why industrial operators increasingly turn to specialist OT security services rather than extending their IT security program unchanged into the plant.
Why Can’t Industrial Systems Be Patched on IT Timescales?
In IT, an urgent patch is often applied within days. In OT, the same patch may wait months or years, and for good reasons.
Industrial equipment has long lifecycles. A distributed control system or set of controllers installed today may run for 15 to 25 years, and many plants still operate engineering workstations on operating systems that vendors stopped supporting long ago. Replacing them means replacing validated, certified systems tied to the physical process.
Patches also need vendor approval. Control system vendors test updates against their own software before customers can apply them, because an untested patch can break the process. Even approved patches often require a restart, and restarting a controller usually means stopping production. Many facilities can only make such changes during planned shutdowns, which in refining and petrochemicals may come every three to five years.
The practical result is that ICS security cannot rely on patching to close vulnerabilities. It has to assume that known weaknesses will remain in place for a long time and build controls around them.
Why Were Industrial Protocols Never Designed for Security?
Most industrial protocols were created for closed, trusted networks long before anyone expected them to connect to the internet. They assume that any device able to send a command is allowed to. A few of the most common examples show the pattern:
- Modbus, introduced by Modicon in 1979, has no authentication or encryption in its original form
- DNP3, developed in the early 1990s for utilities, added secure authentication only in later versions that many sites still do not use
- PROFINET and EtherNet/IP carry industrial traffic over standard Ethernet, inheriting its exposure without adding strong identity checks
- Vendor-specific protocols often allow engineering software to upload new controller logic with little or no verification
Real attacks have exploited exactly these weaknesses. Stuxnet, discovered in 2010, altered the logic of Siemens controllers while showing operators normal readings. In December 2016, the Industroyer malware used standard power grid protocols to open circuit breakers in Kyiv. Neither attack needed to break encryption, because there was none to break.
What Does Segmentation Actually Buy?
If vulnerabilities cannot be patched quickly and protocols cannot verify commands, the most effective control is limiting who can reach the systems at all. That is the purpose of segmentation.
The Purdue model, developed in the 1990s, divides an industrial environment into levels, from physical equipment at the bottom to enterprise IT at the top, with a demilitarised zone between corporate and control networks. The IEC 62443 standards build on this with zones, groups of assets with similar security needs, and conduits, the controlled paths between them.
Done well, segmentation means ransomware on a corporate laptop cannot reach a controller directly, remote vendor access passes through a single monitored point, and a compromise in one production area does not spread to another. It does not make vulnerable devices secure, but it reduces the number of paths an attacker can use to reach them. Segmentation needs monitoring alongside it, since an unmonitored boundary can be crossed quietly.
What Should an ICS Security Playbook Include?
A playbook built for industrial systems starts from these constraints rather than adapting IT habits. The main elements are:
- A verified asset inventory built through passive monitoring rather than active scanning.
- Network segmentation based on the Purdue model or IEC 62443 zones and conduits.
- Controlled, logged remote access for every vendor and integrator.
- Compensating controls for vulnerabilities that cannot yet be patched.
- Change management that treats any controller logic change as a security event.
- Incident response plans written jointly by security and operations staff.
Each element respects the priority of availability and safety while still reducing risk, which is the balance an ICS playbook has to strike.
Frequently Asked Questions
What is the difference between ICS and SCADA?
ICS is the broad term for systems that control industrial processes. SCADA is one type of ICS, used to monitor and control assets spread over large areas, such as pipelines or power grids.
Why can’t industrial control systems use standard antivirus?
Many controllers cannot run third-party software, and on workstations, antivirus can interfere with time-sensitive processes unless it is approved by the control system vendor.
What is the Purdue model?
A reference architecture that divides industrial networks into levels, from field devices to enterprise IT, and is widely used as the basis for segmentation.
Is IEC 62443 mandatory?
Not universally, but it is the most widely adopted international standard for industrial cybersecurity and is referenced by many regulators.
