Securing Critical Infrastructure

Because individual OT devices and protocols often cannot defend themselves, security in critical infrastructure is achieved primarily through architecture: how networks are zoned, what is allowed to talk to what, and how the whole environment is monitored.

This lesson builds a layered defense around the components and protocols you have studied, anchored by the Purdue model.

The Purdue Enterprise Reference Architecture organizes ICS into layered levels, separating business IT from process control.

• Level 0 — sensors and actuators
• Level 1 — PLCs, RTUs, controllers
• Level 2 — SCADA, HMI, supervisory control
• Level 3 — site operations, historians, EWS
• Levels 4-5 — enterprise IT and business networks

The model's value is defining clear boundaries where traffic must be controlled.

The most important boundary is between IT (Levels 4-5) and OT (Levels 0-3). A dedicated industrial DMZ (Level 3.5) sits between them so the two networks never talk directly.

• Data brokers and replicated historians live in the DMZ
• OT data flows out to IT through controlled intermediaries
• No direct path lets IT compromise (e.g., ransomware) reach controllers

This single architectural decision blocks the most common spill-over path.

Beyond IT/OT separation, divide OT itself into zones connected by controlled conduits, the model promoted by the IEC 62443 standard.

• Group assets by function and criticality into zones
• Allow only required traffic across conduits between zones
• Contain an intrusion to one zone rather than the whole plant

A compromise in one cell or line should not be able to reach another.

Standard firewalls filter by IP and port; OT needs firewalls that understand industrial protocols and can enforce intent.

The Safety Instrumented System deserves the strongest isolation. Its job is to bring the process to a safe state, and an attacker who reaches it can disable that last line of defense.

• Keep the SIS on a separate, isolated network from the control system
• Restrict EWS access to safety controllers tightly
• Monitor for any unauthorized attempt to read or modify safety logic

A landmark attack specifically targeted an SIS; treat its integrity as non-negotiable.

Remote access for vendors and engineers is a frequent intrusion path. Replace flat VPNs into OT with brokered, monitored access.

• No direct internet or RDP exposure of OT systems
• Route through a jump host in the DMZ with MFA
• Grant just-in-time, time-limited, least-privilege sessions
• Record sessions for audit

Vendor remote maintenance should be enabled on demand and disabled afterward, not left always-on.

You cannot protect what you cannot see, and you should not actively scan fragile OT. Use passive techniques.

• Build and maintain a complete asset inventory from observed traffic
• Baseline normal communications, then alert on deviations
• Detect new devices, unexpected writes, or unauthorized hosts
• Feed OT alerts into a SOC that understands the process context

Passive sensors at zone boundaries give visibility without disturbing operations.

Air-gapped does not mean safe. Several major ICS incidents crossed the gap via USB drives and compromised vendor equipment.

• Control and scan removable media at dedicated kiosks
• Vet vendor laptops before they connect
• Verify firmware and update provenance for controllers
• Treat the OT supply chain with the rigor from earlier courses

The human and physical entry points often matter more than the network perimeter.

Plan response with OT realities in mind, since shutting down a process can itself be hazardous.

• Build an OT-specific playbook with process engineers
• Define safe manual fallback for running the process if controls fail
• Keep offline backups of PLC logic and configurations
• Rehearse with operations so safety is preserved during response

Resilience, the ability to keep running or fail safely, is as important as prevention.

Frameworks turn these practices into an auditable program.

• IEC 62443 — the core standard for industrial automation security (zones, conduits, security levels)
• NIST SP 800-82 — guidance for securing OT
• Sector regulations for energy, water, and pipelines

Combine the architecture (Purdue, DMZ, segmentation), monitoring, access control, and response into a continuously assessed program rather than a one-time project.

Apply the architecture to stop a common attack path.

You assembled a layered defense for OT environments.

• The Purdue model defines levels and the boundaries to control
• An industrial DMZ prevents direct IT-to-OT traffic; zones and conduits (IEC 62443) contain intrusions
• Protocol-aware firewalls enforce allowed commands; the SIS stays isolated
• Brokered remote access, passive monitoring, and removable-media control close key paths
• Plan OT-aware response and resilience, guided by IEC 62443 and NIST 800-82

Course complete: you can reason about and defend industrial control systems.