OT Security Explained for IT Security Engineers: Plants, PLCs, Zones and Why You Cannot Just Patch

Security engineers who move from IT into energy, water, manufacturing or logistics meet a world where the rules they know are partly inverted. Interviewers for these roles probe whether you can adapt, not whether you can recite a standard. This post covers the differences, the architecture, and the handful of controls that do most of the work.

Different priorities, different constraints

In an office network, a compromised server is a data problem. In a plant, a compromised controller can open a valve, stop a pump or disable a safety system. That changes the order of priorities: safety first, then availability, then integrity, with confidentiality last. It also changes what you can do. Controllers (PLCs) and human-machine interfaces (HMIs) often run for twenty years or more. Vendors certify specific software versions, and patching outside them can end support. Shutdowns for maintenance are scheduled months ahead. Many devices cannot run endpoint agents, and protocols such as Modbus accept commands from anyone who can reach the port, because they were designed for closed networks.

Zones, conduits and the DMZ

The IEC 62443 series gives the vocabulary. Assets are grouped into zones by risk and function, and zones talk only through conduits, which are defined paths with specified allowed traffic. Each zone gets a target security level from 1 to 4, rising with the capability of the attacker it must resist. The standard explicitly allows compensating countermeasures when a legacy device cannot meet a requirement itself, which is how most real plants comply. A DMZ between the business network and the plant brokers data upward (a copy of the historian) and access downward (a jump host), so nothing on the business network talks to a controller directly. The older Purdue model describes similar layers and remains useful vocabulary, even though cloud-connected sensors and vendor remote access cut across its neat levels.

What the incidents teach

Two US advisories frame most interview conversations. In late 2023, an Iran-affiliated group defaced Unitronics PLCs at water facilities. The devices were reachable from the internet and still used default passwords, so no exploit was needed. In February 2024, the Volt Typhoon advisory described state-sponsored actors pre-positioning inside critical-infrastructure IT networks, some for at least five years, so they could disrupt OT in a crisis. The lessons: remove exposure and default credentials first, and treat the IT network as the most likely way into the plant.

The controls that do most of the work

1. Asset inventory, built passively from network traffic, because active scanning can crash fragile devices. US and allied agencies published OT inventory guidance in August 2025.
2. No internet exposure and no default passwords on any controller or HMI.
3. One remote-access path through the DMZ, with MFA, approval per session and recording, replacing modems and remote-desktop tools installed by contractors.
4. Protocol-aware monitoring of conduits, alerting on new connections, controller program downloads and writes from unexpected hosts.
5. Allowlisting on HMIs and engineering workstations, which run a fixed set of software and suit default-deny well.
6. Offline backups of controller programs and rehearsed manual operation.

When a device cannot be patched until the next outage, narrow who can reach it, watch that path closely, record the risk with an owner and an end date, and patch in the planned window. That is how the standard intends you to work, not a workaround.

How interviews test this

Expect a scenario such as an internet-exposed HMI in front of an unpatchable controller. Strong answers remove the exposure today, rebuild remote access, restrict and monitor the conduit, and involve operations in every change. Weak answers start with "install EDR and patch". The full scored answer, with a what-if ladder, is in OT and ICS security. For the network side, see segmentation and how firewalls work, and for hardening the hosts in a plant, application allowlisting.