IoT & OT Security: Defending Cyber-Physical Systems

Operational technology (OT) is the hardware and software that monitors and controls physical processes — the industrial control systems (ICS) running factories, utilities, pipelines, and building services. Alongside it sits the sprawling world of the Internet of Things (IoT): connected sensors and devices that increasingly bridge the physical and digital. Both are cyber-physical systems, where a security failure produces a physical consequence, and that changes everything about how they must be defended.

The Purdue model as a mental map

The Purdue Enterprise Reference Architecture organises an industrial environment into levels, from the physical process at the bottom to enterprise business systems at the top. At Level 0 are field devices — the sensors and actuators touching the process itself. Level 1 holds the controllers, chiefly programmable logic controllers (PLCs), that execute the control logic. Level 2 is supervisory control: the SCADA systems and human-machine interfaces (HMIs) operators watch. Level 3 covers site-wide operations and manufacturing execution. Above that sits enterprise IT at Levels 4 and 5.

The model is not a product or a standard to certify against — it is a way of thinking about where a system sits and what should be allowed to talk to it. Its enduring value is the principle that lower levels are more sensitive, closer to physical harm, and should be progressively more isolated from the internet-facing top.

Segmentation and the industrial DMZ

The single most important control in the model is the boundary between IT and OT, formalised as the Level 3.5 industrial DMZ. In a well-designed environment, enterprise systems never talk directly to control systems. Instead, all traffic is brokered through the DMZ — data historians replicate upward, jump hosts mediate remote access, and no flow crosses without passing an inspection point. This segmentation is what contains an incident: a compromise of the corporate network should not be able to reach a PLC.

Flat networks are the original sin of OT security. When enterprise IT and the plant floor share one broadcast domain, a phishing email becomes a threat to the physical process.

Many historic industrial incidents trace back to exactly this: a boundary that was assumed to exist but did not, or a "temporary" connection that quietly bypassed the DMZ. Verifying segmentation — proving that the paths which should be blocked really are — is often the highest-value work in an OT assessment.

Insecure legacy protocols

Industrial protocols such as Modbus, DNP3, and their siblings were designed decades ago for isolated, trusted networks. Many carry no authentication and no encryption by default: a device accepts a command because it arrived on the wire, not because the sender proved who they were. On a segmented network this was tolerable; exposed to a broader network, it means anyone who can reach a controller can potentially instruct it.

Because these protocols and the equipment running them can remain in service for twenty or thirty years, "just patch it" is rarely available. The realistic defence is compensating controls: strict segmentation, allow-listed communications, protocol-aware monitoring, and read-only access wherever control is not genuinely needed. You protect the fragile device by controlling what can reach it, not by hardening the device itself.

Why availability and safety dominate

IT security is usually framed by the CIA triad — confidentiality, integrity, availability — in that order. OT inverts it. Here availability and safety come first, then integrity, and confidentiality last. A control system that stops is a production outage or a safety event; a plant does not care much whether a temperature reading was secret, but it cares enormously that the reading is correct and that the system keeps running.

Testing without breaking

This reordering reshapes the assessment itself. An aggressive scan that would be routine on an IT network can crash a fragile PLC, and crashing a PLC can stop a process. OT testing is therefore conservative by necessity — favouring passive traffic analysis, working on test benches or during planned maintenance windows, and coordinating closely with the engineers who run the plant. The goal is to understand risk without becoming the incident. Guidance from agencies such as CISA reflects this cautious, safety-first posture.

IoT: the same problem at scale

Consumer and enterprise IoT devices bring these issues into every building. They ship with default credentials, expose management interfaces, run firmware that is rarely updated, and often phone home to cloud services outside the operator's control. Individually modest, they matter because they multiply and because they frequently sit on networks with no segmentation at all. The defensive playbook echoes OT: inventory what you have, isolate devices onto their own segments, change defaults, and monitor for the behaviour that signals compromise.

A defender's priorities

Securing cyber-physical systems is less about exotic exploits and more about architecture and discipline. Know every asset you operate, enforce the segmentation the Purdue model describes, wrap fragile legacy equipment in compensating controls, and always put safety and availability ahead of the reflexes learned in IT. Do that, and the physical process stays where it belongs — insulated from the noise of the connected world.