In December 2015, operators at three Ukrainian electricity distribution companies watched cursors move across their control screens as intruders opened circuit breakers one after another. About 225,000 customers lost power in winter. The attackers had started months earlier with phishing emails in the companies' business networks, then found their way into the systems that ran the grid.
Where a system runs, and how firmly it is separated from everything else, decides what an attacker who gets in somewhere can reach. On the CompTIA Security+ SY0-801 exam this sits under objective 3.1, which expects you to compare the security implications of different architecture models. This lesson covers on-premises infrastructure, operational technology (OT), air-gapped networks, and the difference between physical and logical segmentation.
On-premises infrastructure means full control and full responsibility
On-premises infrastructure is hardware the organization owns or leases, in a facility it controls. Every row of the shared responsibility table from the first lesson in this section belongs to the organization: the building, badge readers and cameras, power and cooling, hardware, hypervisors, operating systems, applications and data.
That brings real advantages. The organization knows exactly where its data sits, which matters for strict data-residency rules and classified work. It can choose and inspect every component, add specialized hardware such as hardware security modules, and keep internal services running when the internet link is down. No other tenant shares its hardware, and no cloud provider's mistake can expose it.
The costs are the other side of the same control. Servers are bought up front and typically replaced every three to five years. Someone has to patch every layer, watch the systems around the clock, and arrange and test a disaster recovery site, because none comes with the building. Adding capacity means ordering hardware and waiting weeks. Physical security is the organization's job, and so is the insider risk of staff with hands on the equipment. Old systems also tend to pile up on premises, because nothing outside forces an upgrade.
On the exam, wording such as "must retain complete control over the hardware," "data can't leave the building," or "can't depend on a third party" points to on-premises. Many organizations end up hybrid: domain controllers, plant systems and legacy applications stay on premises while newer workloads move to the cloud.
Operational technology controls physical processes, so availability and safety come first
Operational technology is the hardware and software that monitors and controls physical equipment: manufacturing lines, power generation and distribution, water and wastewater treatment, pipelines, and building systems such as HVAC, elevators and door controllers. In plain terms, an OT environment usually includes rugged controllers that read sensors and drive motors, valves and breakers; operator workstations that show the process on screen and accept commands; supervisory systems that gather data from equipment spread across a plant or a whole region; and historians that record process readings over time. Many of these devices run specialized real-time operating systems that must respond within strict time limits. In industry you'll also hear these systems called industrial control systems, and the wide-area supervisory systems called SCADA.
The difference from IT is what failure costs. When an office server fails, work stops. When a controller fails or is tampered with, a tank can overflow, a turbine can overheat, chemicals can be dosed wrongly, or a city can lose power. That reorders the priorities. In most IT systems confidentiality gets the most attention; in OT, safety and availability come first and integrity follows closely, because a changed setpoint is a physical hazard. Confidentiality usually comes last.
Those priorities shape every security decision. A controller can't be rebooted on a Tuesday afternoon because a patch is ready. Patches have to be certified by the equipment vendor, tested, and installed during a planned shutdown that may come once a year. Some vendors withdraw support if unapproved software, including antivirus, is installed on their operator workstations. A security team that treats OT like an office network can cause the outage it was trying to prevent.