What is operational technology?
Operational technology (OT) is the computing that runs the physical world: manufacturing lines, power generation and distribution, water and wastewater treatment, oil and gas pipelines, and building systems such as HVAC, elevators and door controllers. Where IT moves and stores data, OT reads sensors and drives motors, valves, pumps and breakers. Industrial control systems (ICS), which run plants and utilities, make up much of OT, and the two terms are often used interchangeably.
A typical OT environment includes:
- Programmable logic controllers (PLCs) and remote terminal units that read sensors and control equipment
- Human-machine interfaces (HMIs), the operator screens that show the process and accept commands
- SCADA (supervisory control and data acquisition) systems that supervise equipment spread across a plant or a whole region
- Historians that record process readings over time
Safety and availability come first
When an office server fails, work stops. When a controller fails or is tampered with, a tank can overflow, a turbine can overheat, chemicals can be dosed wrongly or a city can lose power. That reorders security priorities. In OT, safety and availability come first, integrity follows closely because a changed setpoint is a physical hazard, and confidentiality usually comes last. A controller can't be rebooted on a Tuesday afternoon just because a patch is ready, and a security team that treats OT like an office network can cause the very outage it was trying to prevent.
Why OT is hard to secure
- Long lifecycles: controllers often stay in service for decades, and operator workstations may run Windows versions long out of support.
- Difficult patching: updates must be approved by the equipment vendor, tested, and installed during planned shutdowns that may come once a year.
- Insecure protocols: classic Modbus (TCP 502) and DNP3 (port 20000) have no authentication or encryption, so any device that can reach a controller can send it a valid command.
- Fragile devices: an ordinary active vulnerability scan can crash an older controller, so OT teams rely on passive monitoring.
- No room for agents: many devices can't run antivirus or EDR, and some vendors withdraw support if unapproved software is installed.
In December 2015, attackers who had first phished their way into the business networks of three Ukrainian electricity distributors reached the control systems and opened breakers, cutting power to about 225,000 customers.
Protecting OT
When a device can't protect itself, the protection moves around it:
- Separate OT from the business network with firewalls and a buffer zone between them, so no traffic flows straight from an office PC to a controller. The Purdue model is a common reference design that arranges OT in levels from field devices up to the enterprise network.
- Use one-way data diodes to send process data out to business systems without letting anything back in.
- Route vendor remote access through a jump host with MFA, enabled only for the maintenance window and recorded.
- Apply application allow lists on operator workstations, and monitor passively with tools that understand industrial protocols and alert on commands such as a firmware write.
- Air-gap the most critical systems, remembering that USB drives and maintenance laptops still cross the gap.
The main references are the ISA/IEC 62443 series and NIST SP 800-82, NIST's guide to OT security.
OT vs. IT vs. IoT
IT systems handle data and are patched and replaced every few years. IoT devices, such as cameras, sensors and smart building gear, are network-connected devices that aren't general-purpose computers. They overlap with OT, but OT is defined by monitoring and controlling physical processes, where a failure can also endanger people. Both share default credentials, rare patches and a need for segmentation.
Operational technology on the CompTIA Security+ exam
On SY0-801, OT appears in objective 2.3 as a threat vector, legacy equipment connected to networks it was never designed for, and in objective 3.1 as an architecture model with its own security trade-offs. When a scenario says an industrial controller or SCADA system can't be patched until the next planned shutdown, the best answer is isolation through segmentation plus compensating controls, not installing antivirus or patching immediately. Running a full active scan is a trap, since it can crash the device, and assuming an air-gapped network has no malware risk ignores removable media. Remember the inverted priority order: safety and availability first, confidentiality last.