Threats

What actually goes wrong in OT

OT risk is described by consequence, not by malware family. These are the outcomes a defensive programme exists to prevent.

Why should I care?

Framing risk as loss of view, loss of control or loss of safety function lets engineering and security agree on priorities — a CVE list never does.

Concern

Unauthorized changes to controller logic

Logic defines physical behaviour; a change can move equipment outside safe or intended operation.

Prerequisites

Network reach to the controller
Engineering capability or tooling
Controller in a programmable state

Detection

Program download events
Baseline comparison differences
Mode changes

Prevention

Restricted programming conduits
Keyswitch discipline
Controller access protection

Recovery

Validated logic backups
Engineering-led restoration
Post-restore process verification

Concern

Loss of process visibility

Operators cannot make safe decisions about a process they cannot see.

Prerequisites

Disruption of HMI/SCADA or the data path

Detection

Stale values
Communication loss alarms
Historian gaps

Prevention

Redundant views
Independent local indication
Resilient supervisory architecture

Recovery

Fallback to local panels
Documented manual monitoring procedures

Concern

Loss of control

The process continues while operators cannot influence it.

Prerequisites

Disruption of the command path or controller availability

Detection

Command failures
Controller unavailability
Watchdog alarms

Prevention

Local control capability
Redundant paths
Segmentation limiting blast radius

Recovery

Manual operation procedures
Staged restoration with engineering

Concern

Manipulation of the operator view

Operators may act correctly on incorrect information, or fail to act when they should.

Prerequisites

Access to supervisory systems or the data path

Detection

Cross-checking independent instrumentation
Frozen or implausible values

Prevention

Integrity of supervisory hosts
Independent measurement paths

Recovery

Verify field state physically before trusting displays

Concern

Safety system interference

Removing an independent protection layer is the highest-consequence outcome in OT.

Prerequisites

Reach to safety systems or their engineering tooling
Programmable state

Detection

Safety change alarms
Bypass records
Unexplained trips

Prevention

Independence of the safety layer
Formal management-of-change
Dedicated safety engineering hosts

Recovery

Proof testing before returning to service
Safety authority sign-off

Concern

Insecure vendor remote access

Standing third-party access is a supported, authenticated path straight into OT.

Prerequisites

Permanent accounts
Shared credentials
Missing MFA

Detection

Sessions without work orders
Out-of-scope destinations

Prevention

Default-off access
Named identities with MFA
Time-bounded approval

Recovery

Disable access, review session records, re-issue credentials

Concern

Engineering workstation compromise

It is the shortest route from a conventional intrusion to physical consequence.

Prerequisites

Reachability from IT or via media
Unmanaged software or credentials

Detection

Unexpected execution
Project file changes
Controller contact after suspicious activity

Prevention

Dedicated, hardened, non-internet builds
Allow-listing
Jump-host mediation

Recovery

Rebuild from known-good images
Re-verify all controller programs

Concern

Compromised credentials

Legitimate credentials produce activity that looks entirely normal.

Prerequisites

Credential theft, reuse or shared accounts

Detection

Anomalous authentication patterns
Access from unusual hosts

Prevention

MFA
Named accounts
Tiered administration
No shared operator logins

Recovery

Coordinated credential reset with operations awareness

Concern

Firmware modification

Firmware persists beneath application-level recovery and is rarely verified.

Prerequisites

Device access
Unsigned update mechanism

Detection

Version drift against the register
Unexpected file transfers to devices

Prevention

Signed firmware where available
Restricted update paths

Recovery

Vendor-supported reflash during a planned window

Concern

IT-to-OT ransomware propagation

Even without touching controllers, it stops operations and destroys the systems you need to recover.

Prerequisites

Flat or weakly separated networks
Shared credentials
Unprotected backups

Detection

Mass file operations
Lateral movement patterns
Boundary traffic anomalies

Prevention

Real segmentation
Credential separation
Offline backups
A practised isolation procedure

Recovery

Isolate, restore from validated backups, verify process integrity before restart

Concern

Flat networks

Any compromise anywhere becomes a compromise everywhere.

Prerequisites

No zones, no conduits, permissive rules

Detection

Traffic analysis showing unrestricted east/west flows

Prevention

Zone and conduit design
Deny-by-default boundaries

Recovery

Phased segmentation programme prioritising highest-consequence zones

Concern

Internet-exposed OT systems

Advisories repeatedly show exposed devices with default credentials being reached directly.

Prerequisites

Public IP reachability
Weak or default authentication

Detection

External attack-surface review
Inbound boundary logs

Prevention

No direct exposure — ever
DMZ termination
Credential hygiene

Recovery

Remove exposure, rotate credentials, review device state

Concern

Unsupported legacy systems

No patches exist, so compensating controls carry the entire risk.

Prerequisites

End-of-support hardware or software still in service

Detection

Inventory lifecycle status
Vulnerability data with no fix available

Prevention

Isolation, strict conduits, enhanced monitoring, lifecycle planning

Recovery

Planned replacement with capital budget alignment

Concern

Removable media

It crosses boundaries that network controls cannot see.

Prerequisites

Unrestricted USB ports
No sanitisation process

Detection

Device insertion events
Execution following insertion

Prevention

Policy with technical enforcement
Sanitisation kiosks

Recovery

Retain media, analyse, review affected hosts

Concern

Supply-chain compromise

Trusted software, hardware and integrators bypass most perimeter thinking.

Prerequisites

Trusted update or delivery channel

Detection

Behaviour change after updates
Unexpected vendor software network activity

Prevention

Vendor security requirements
Validated installation media
Controlled update paths

Recovery

Vendor coordination and staged verification

Concern

Compromised or untested backups

Backups decide whether recovery takes hours or weeks.

Prerequisites

Online-only backups
No restoration testing

Detection

Backup job monitoring
Retention policy change alerts

Prevention

Offline or immutable copies
Scheduled restore tests
Include controller logic and firmware

Recovery

Rebuild backup capability first if it was destroyed

Concern

Unauthorized wireless connectivity

It quietly bypasses the wired architecture you invested in.

Prerequisites

Physical access to install a device
Vendor-supplied cellular equipment

Detection

OUI review
Wireless monitoring
Physical inspection

Prevention

Wireless policy
Contract terms for vendor connectivity

Recovery

Remove with owner coordination, review what was reachable

Adversaries

Who causes these outcomes

State-aligned intrusion sets

Long-dwell access to critical infrastructure, often pre-positioning rather than acting immediately.

Criminal ransomware crews

Enterprise-side encryption that stops production because IT and OT were not separated.

Hacktivists and opportunists

Internet-exposed HMIs and default credentials, especially at small utilities.

Insiders and third parties

Legitimate access misused, or unmanaged vendor connectivity abused by others.