Primer / OT fundamentals
Why OT security is not IT security with a different badge
In IT, the priority is usually confidentiality, then integrity, then availability. In OT the order inverts: a process that stops, or behaves unpredictably, has physical and safety consequences. That is why patch cycles, scanning tools and incident playbooks borrowed directly from IT can cause the very outages they are meant to prevent.
Practical OT security starts with knowing what is on the network, separating it into zones by consequence, and controlling every conduit between them.
Architecture / Segmentation
The industrial DMZ: your most important network you rarely think about
Level 3.5 of the Purdue Model is where enterprise and control networks meet. A well-designed industrial DMZ means no direct connection from IT to PLCs: historians replicate outward, remote users land on hardened jump hosts, and patches are staged before they reach production.
If you can draw a line from a corporate laptop to a controller without crossing the DMZ, that is the first finding to fix.
Operations / Access
Vendor remote access without opening the plant
Integrators and OEMs need access to support equipment. Permanent VPNs and shared credentials are among the most common weaknesses in industrial environments. Time-bound, individually attributable, brokered sessions to specific assets reduce that exposure without slowing support.