Industrial Cybersecurity: Monitoring, Segmentation & Incident Response

Industrial cybersecurity focuses on protecting operational technology (OT) — the hardware and software that controls physical processes in manufacturing, energy, water, and other critical infrastructure. This article answers the most common questions about the three pillars of a robust OT security program: continuous monitoring, network segmentation, and incident response, explaining what they are, why they matter, and how they work together.

Formula

The calculator estimates annual downtime caused by cybersecurity incidents, based on the number of OT devices, the mean time to detect (MTTD) an incident, and the mean time to respond (MTTR). The formula assumes each device experiences one incident per year, which is a conservative planning assumption.

Availability loss (hours/year) = (Number of devices × MTTD / 8760) + (Number of devices × MTTR / 8760)

Availability (%) = 100 − (Availability loss / 8760 × 100)

Variables:

• OT devices – total number of controllers, sensors, and other connected assets in the industrial network
• MTTD – average hours from when an incident starts until it is detected
• MTTR – average hours from detection until the system is restored to normal operation
• 8760 – number of hours in a non-leap year

Worked Example

Using the default values: 500 devices, MTTD of 24 hours, MTTR of 2 hours.

Availability loss = (500 × 24 / 8760) + (500 × 2 / 8760) = (12000 / 8760) + (1000 / 8760) = 1.37 + 0.11 = 1.48 hours/year

Availability = 100 − (1.48 / 8760 × 100) = 100 − 0.0169 = 99.98%

So with these assumptions, the facility would lose about 1.5 hours of production per year to cybersecurity incidents, achieving 99.98% availability. This is a planning estimate, not a precise prediction.

Why Industrial Cybersecurity Is Different

IT networks prioritize confidentiality, integrity, and availability (CIA) in that order. OT networks invert this: safety and availability come first, then integrity, then confidentiality. A security measure that interrupts a chemical process or stops a production line is unacceptable, even if it blocks a cyberattack. This fundamental difference shapes every decision about monitoring, segmentation, and incident response in industrial environments.

Another key difference is the age and fragility of OT equipment. A typical plant may run programmable logic controllers (PLCs) and legacy protocols like Modbus or Profinet that were designed decades ago, with no built-in security. Patching is often impossible because the vendor no longer supports the device, or because a patch would require a shutdown that costs more than the risk it mitigates. This is why segmentation and monitoring are so important: they protect devices that cannot protect themselves.

How Monitoring Works in OT

Industrial monitoring is the continuous observation of network traffic, device logs, and physical process values to detect anomalies that could indicate a cyber threat. Unlike IT monitoring, which focuses on servers and user endpoints, OT monitoring must understand industrial protocols and the physical process itself.

Common monitoring techniques include:

• Passive network monitoring – tapping switches or using port mirroring to capture traffic without affecting the network. This is the safest approach because it adds no latency and cannot fail closed.
• Active polling – periodically querying devices for status and configuration. This can interfere with legacy devices, so it must be used cautiously.
• Log collection – gathering logs from PLCs, HMIs, historians, and other devices. Many OT devices have limited logging, so this may require a syslog forwarder or a serial-to-Ethernet converter.
• Process monitoring – comparing real-time sensor values (temperature, pressure, flow) against expected baselines. A sudden change without a corresponding production command may indicate a cyber-physical attack.

Monitoring data is typically fed into a security information and event management (SIEM) system or a specialized OT security platform. The goal is to detect threats that bypass the perimeter, such as a USB drive infected with malware or a compromised vendor laptop.

Network Segmentation Strategies

Segmentation divides the industrial network into smaller zones, each with its own security controls, so that a compromise in one zone does not spread to the entire plant. The most common model is the Purdue Enterprise Reference Architecture (PERA), which defines levels from Level 0 (physical processes) to Level 4 (enterprise IT). Traffic should only flow between adjacent levels, and only through controlled gateways.

Practical segmentation steps include:

1. Inventory every device and map its communication paths.
2. Group devices into zones based on function and risk (e.g., safety systems, control systems, HMIs, engineering workstations).
3. Place firewalls or routers between zones, with rules that allow only necessary protocols and ports.
4. Use a demilitarized zone (DMZ) for any connection between the OT network and the IT network.
5. For remote access, use a jump host or virtual private network (VPN) that terminates in the DMZ, not directly into a control zone.
6. Monitor traffic crossing zone boundaries, since legitimate inter-zone traffic should be predictable.

Segmentation also helps with compliance: many regulations and standards, such as IEC 62443 and NERC CIP, require or strongly recommend zone-based segmentation. Even without a formal mandate, segmentation reduces the blast radius of any single compromise.

Incident Response for OT Environments

Incident response in OT follows the same general lifecycle as IT — preparation, detection, containment, eradication, recovery, and lessons learned — but with critical adaptations. The most important difference is that the response team must include OT engineers who understand the process and can assess the physical safety impact of any action.

Key considerations for OT incident response:

• Safety first – if an incident could affect physical safety, the first step may be to manually shut down the process, even before confirming the cause.
• Do not rush to reboot – in IT, rebooting a compromised machine is standard. In OT, a reboot may cause a loss of process control or fail to clear malware from a PLC’s firmware.
• Preserve evidence – capture network traffic and device memory before making changes, but be aware that some OT devices have volatile memory that is lost on power cycle.
• Containment may mean physical isolation – pulling a network cable or turning off a switch port can be faster and safer than trying to block traffic via software.
• Recovery requires testing – after restoring from backups, verify that the process runs correctly in a safe mode before returning to full production.

Every plant should have a written incident response plan that includes contact information for OT engineers, IT security, management, and external vendors. The plan should be tested with tabletop exercises and simulated incidents at least once a year.

Common Pitfalls and Misconceptions

One common misconception is that air-gapping (physically disconnecting the OT network from the internet) makes monitoring unnecessary. In reality, most air-gapped networks are breached via USB drives, vendor laptops, or rogue Wi-Fi. Even a fully isolated network needs monitoring to detect insider threats and accidental infections.

Another pitfall is deploying security tools that are not designed for OT. Traditional IT vulnerability scanners can crash PLCs by sending unexpected packets. Similarly, active network scanning can overload legacy devices. Always test any security tool in a lab environment before deploying it to a production network.

A third mistake is treating segmentation as a one-time project. Networks change as new devices are added, processes are modified, and temporary connections are made for maintenance. Segmentation must be reviewed and updated regularly, and any exception (such as a temporary remote access connection) should be logged and removed when no longer needed.

How to Choose the Right Approach

There is no one-size-fits-all solution. The right level of monitoring, segmentation, and incident response depends on the industry, the age of the equipment, the risk tolerance, and the budget. A small water treatment plant will have different needs than a large petrochemical refinery.

Start with a risk assessment to identify the most critical processes and the most likely attack paths. Then prioritize investments: segmentation is often the highest-value first step because it reduces the spread of an attack. Monitoring is next, because it provides visibility. Incident response planning is essential but can be done with internal resources and does not require expensive tools.

If the budget is limited, focus on the basics: inventory your devices, segment the network into at least two zones (IT and OT), enable logging on key devices, and write a simple incident response plan. These steps alone will reduce risk significantly.

Frequently Asked Questions

What is the difference between IT and OT security?

IT security protects data and user systems, prioritizing confidentiality. OT security protects physical processes and human safety, prioritizing availability and safety. OT systems often run legacy software that cannot be patched, and security measures must not disrupt production.

Can a firewall alone protect an industrial network?

No. A firewall is a necessary part of segmentation, but it cannot detect attacks that use legitimate protocols or that originate from inside the network. Monitoring is required to see what is actually happening on the network, and incident response planning is required to react when something is detected.

How often should we test our incident response plan?

At least once a year, but more often if the plant changes significantly or after a major incident. Tabletop exercises are a low-cost way to test the plan without disrupting production. Full-scale simulations that involve shutting down a process should be done during planned maintenance windows.

Is it safe to use active vulnerability scanners in OT?

Generally no, unless the scanner is specifically designed for OT and has been tested against the exact devices in your environment. Active scanning can crash legacy PLCs or cause unintended state changes. Passive monitoring is safer and is the recommended first step.

What is a DMZ and why is it important?

A DMZ (demilitarized zone) is a small network that sits between the IT and OT networks. It contains servers that need to be accessed from both sides, such as data historians or patch management servers. No direct traffic flows between IT and OT; all communication goes through the DMZ, which can be monitored and controlled.

How do we handle remote access for vendors?

Remote access should be controlled, logged, and limited to specific times and systems. Use a VPN that terminates in a DMZ, then require a second authentication step to reach the OT network. Many plants use a jump host (a dedicated computer) that the vendor connects to, and the jump host is the only device that can communicate with the control network.

Related

• Smartphone Radiation: Real Risks & SAR Levels
• Valve Index Advantages Over Newer VR Headsets
• Show Developer Tab in Excel Ribbon (Windows & Mac)

in t | OT devices | count | 500 | 1 | 100000
in m | Mean time to detect (hours) | h | 24 | 0 | 8760
in r | Mean time to respond (hours) | h | 2 | 0 | 8760
out a | Availability loss (hours/year) | h | (t * m / 8760) + (t * r / 8760) | 1
out p | Availability (%) | % | 100 - ((t * m / 8760) + (t * r / 8760)) / 8760 * 100 | 2