The OT Field Guide / Free for the community
The principles we work by.
Ten principles of OT security, written by practitioners for engineers, operators and security teams. Each comes with a figure you can operate, so the idea is understood, not just read. About 48 minutes end to end.
- 01OT is not ITWhy the controls that protect an office can endanger a plant.Why the controls that protect an office can endanger a plant.5 min · figure
- 02Safety holds the final wordEvery security change passes the plant before it passes security.Every security change passes the plant before it passes security.4 min · figure
- 03You cannot secure what you have not walkedDrawings describe the plant someone intended. The floor shows the plant you have.Drawings describe the plant someone intended. The floor shows the plant you have.5 min · figure
- 04Zones and conduitsGroup what shares the same risk. Control everything that crosses between groups.Group what shares the same risk. Control everything that crosses between groups.6 min · figure
- 05Security levels: match the defence to the adversaryNot every zone needs the same protection. Every zone needs the right protection.Not every zone needs the same protection. Every zone needs the right protection.5 min · figure
- 06Accountability lives at the assetMicro Governance: when everyone owns the plant, nobody owns the PLC.Micro Governance: when everyone owns the plant, nobody owns the PLC.5 min · figure
- 07Patch by consequence, compensate where you cannotA CVSS score does not know what your controller controls.A CVSS score does not know what your controller controls.5 min · figure
- 08Remote access: brokered, time-bound, watchedVendors need to reach your plant. They should never reach it directly.Vendors need to reach your plant. They should never reach it directly.4 min · figure
- 09No cyber event may defeat a safety functionThe safety instrumented system is the last automated layer between an upset and a disaster.The safety instrumented system is the last automated layer between an upset and a disaster.5 min · figure
- 10Evidence over assertionA claim is only as strong as who checked it, how much they checked and how recently.A claim is only as strong as who checked it, how much they checked and how recently.4 min · figure