Most small and midsize energy and industrial companies have two technology worlds that rarely talk to each other. The first is IT: laptops, email, accounting, file shares. The second is operational technology, or OT: the controllers, sensors, drives, and software that run pumps, compressors, valves, metering, batch processes, and plant equipment.
IT security is a mature discipline, and many of its habits do not transfer cleanly to OT. Understanding the difference is the first step toward protecting equipment that keeps the business running.
What makes OT different
Availability beats confidentiality
In IT, protecting data is the priority. In OT, keeping the process running safely is the priority. Rebooting a controller to apply a patch might be unacceptable in the middle of a production run, or even dangerous.
Long lifecycles
A laptop is replaced in four years. A controller or SCADA workstation may run for fifteen or twenty. Many run operating systems the vendor no longer supports, which means patching is often not an option and other controls must make up the difference.
Vendor-managed and proprietary
Equipment vendors often control the software, the update schedule, and the remote access. Changing something without their involvement can void support agreements.
Safety consequences
A compromised email account is costly. A compromised controller can affect people, equipment, and the environment. That raises the stakes for every decision.
Where small operators get exposed
- Flat networks. Office computers and control equipment sit on the same network, so malware from a phishing email can reach the plant floor.
- Unmanaged remote access. Vendors and engineers connect through remote tools set up years ago, sometimes with shared passwords.
- No asset list. Nobody can say what controllers, HMIs, and gateways exist or where they are.
- Default credentials. Devices still use passwords from the factory.
- USB drives and laptops. Technicians plug in personal drives and laptops to update or troubleshoot.
Practical first steps
1. Build an inventory
Walk the site and list every networked device: make, model, firmware, location, who supports it, and how it connects. A spreadsheet is a fine start. You cannot protect what you cannot see.
2. Separate OT from IT
Place a properly configured firewall between the business network and the control network. Allow only the specific traffic needed. This single step limits how far ransomware can spread. Work with the equipment vendor so the change does not interrupt operations.
3. Control remote access
- Use one managed remote access method with multi-factor authentication.
- Give each vendor and employee their own account.
- Enable access only when needed and log every session.
- Remove access when a contract ends.
4. Change default passwords
Where the device supports it, replace factory credentials with unique ones stored in a password manager. Coordinate with operations so changes are scheduled.
5. Back up configurations
Keep current copies of controller programs, HMI projects, and device configurations offline. After an incident, the ability to restore known-good logic is what shortens downtime.
6. Plan for an incident
Write a one-page plan: who is called, who can authorize shutting down a process, how to run manually, and when to contact law enforcement and your insurer. Rehearse it once a year.
Standards worth knowing
ISA/IEC 62443 is a widely used family of standards for industrial automation security, and NIST and CISA publish guidance for control systems. You do not need to adopt a full standard on day one, but they give you a roadmap for maturing over time. Utilities and pipeline operators may also have NERC CIP or TSA obligations, which we cover in other posts.
Working with your operations team
Security projects fail in OT when IT imposes changes without operations. Bring plant managers, controls engineers, and vendors in early. Frame the work around uptime and safety, because that is what they care about, and it is true.
How Ironfield Cyber can help
Ironfield Cyber offers OT security awareness and assessments for energy and industrial companies, focused on practical segmentation, remote access, and recovery planning. If you want a clear picture of where your plant and business networks touch, we can start with a walk-through and a simple asset inventory.