In OT, availability is safety and patching is a negotiation

An IT security engineer walking into a plant for the first time usually makes the same suggestion within an hour: patch it. The response — that the controller has not been rebooted since 2019, that the vendor voids support for unapproved changes, and that stopping the line costs more per hour than the security budget for the year — is not obstruction. It is the actual constraint.

The priorities are reversed

Enterprise security optimises for confidentiality first. Industrial environments optimise for safety and availability, because the failure mode is not a data breach but a physical event. A control system that stops is a production halt; a control system that behaves incorrectly can be a fire. Any security measure that risks either will be refused, and correctly so.

The protocols were never designed for hostile networks

• Modbus has no authentication. A valid-looking write is a valid write.
• DNP3 added secure authentication late, and it is frequently not enabled.
• S7comm carries proprietary behaviour that has been reverse-engineered and abused.
• OPC UA is the modern option with real security features, which are often switched off during commissioning for convenience and never switched back on.

Because these protocols trust anything on the wire, network position is the control. If an attacker can reach the segment, the protocol will cooperate.

What the historical incidents actually teach

Stuxnet demonstrated that air gaps are a design intention rather than a fact. Industroyer showed that attackers will learn the protocols properly, not just fuzz them. TRITON crossed into the safety instrumented system — the layer that exists to prevent physical harm — which is why it changed how the industry talks about risk. The generalisable lesson from all three is not the malware; it is that patient adversaries study the process, and process knowledge is the real payload.

Controls operations will accept

Passive monitoring first, because it changes nothing and reveals an asset inventory nobody had. Then segmentation between levels of the Purdue model, with explicitly allowed flows. Then secure remote access to replace whatever the vendor is currently using, which is usually worse than anyone wants to know. Patching, where it happens, is planned into outage windows with compensating controls in between.

Speak the plant language

The most effective OT security people are the ones who can discuss a process hazard analysis without translating it into IT terms. Availability is not an SLA here. It is the thing the site exists to protect.

Start with a passive asset inventory. Almost every industrial site discovers devices that nobody knew were connected.