# What Is OT Security? A Plant Manager's Version URL: https://limehawk.io/reports/what-is-ot-security Published: 2026-10-01 Author: Corey Watson, Managing Member Topic: Guides Read time: 6 min OT security protects the computers and controllers that run physical equipment. The goal is keeping the line running and people safe, not just protecting data. > **TL;DR** OT is the gear that moves things: PLCs, HMIs, SCADA, and the old Windows box bolted to the side of a machine. OT security is keeping that gear off the internet, walled off from the office network, and reachable only by the people who should reach it. You usually can't patch your way there. You isolate, you lock down remote access, and you make sure you can still run the line by hand if it all goes sideways. - CISA core OT mitigations: 5 ## What is OT security? OT security is protecting the computers and controllers that run physical equipment. Presses, mixers, conveyors, CNC machines, the HMI screen your operators tap all day, and the PC in the corner running the SCADA software. If it makes something move, heat, cool, or stop, it's OT. NIST's definition, from its [Guide to Operational Technology Security (SP 800-82 Rev. 3)](https://csrc.nist.gov/pubs/sp/800/82/r3/final), is "programmable systems and devices that interact with the physical environment." Those systems "detect or cause a direct change through the monitoring and/or control of devices, processes, and events." In plain terms: IT holds your data. OT runs your plant. The security job is keeping those systems running, keeping people safe around them, and keeping outsiders from reaching them. That's the work we do for [manufacturers in East Tennessee](/industries/manufacturing). ## How is it different from IT security? The priorities flip. In the office, the worst day is someone stealing your data. On the plant floor, the worst day is a machine doing something it shouldn't, or the line sitting dead for a shift. NIST says it directly. In a typical IT system, "primary concerns include data confidentiality and integrity." For OT, the concerns are safety, equipment loss, and lost or damaged product, and "any security measure that impairs safety is unacceptable." The same guide says [availability is "generally the greatest concern"](https://csrc.nist.gov/pubs/sp/800/82/r3/final) for OT. That changes how you do the basics: - **Rebooting is not a fix.** NIST notes that typical IT moves like rebooting a component "are usually not acceptable for OT." Many processes run continuously, and outages get scheduled days or weeks ahead. - **Security software can break things.** Legacy systems often lack the horsepower, logging, or even password protection modern tools expect. NIST warns that "indiscriminate use of IT security practices in OT may cause availability and timing disruptions." - **Different people own it.** Control networks are usually run by controls engineers and machine vendors, not the IT person. That's how a lot of plants end up with two networks nobody fully owns. If your IT provider treats the HMI like an office laptop, that's the problem. It isn't one. ## Why can't you just patch the old PC? Because the machine's software was certified against one version of Windows, and the vendor never certified it on anything newer. Patching it, or upgrading it, can mean the equipment stops talking to its controller. On a machine that runs your production, that is not a risk anyone signs off on. NIST doesn't pretend otherwise. [SP 800-82](https://csrc.nist.gov/pubs/sp/800/82/r3/final) says OT updates "need to be thoroughly tested by both the vendor and the end user" before they go in. It also says "patching older OT components that run on unsupported OSs may not be an option." When that's the case, the guidance is to add protection around the machine. Firewalls and inline security devices in front of the box, instead of changes on it. So the old XP box stays. The question is what you put around it. ## What actually reduces the risk? Five things, and they're not exotic. CISA, the FBI, EPA, and DOE put them in a [fact sheet on OT mitigations](https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology) in 2025. Here's the plant manager's version. **1. Get it off the internet.** CISA's words: "OT devices are easy targets when connected to the internet." They get found by people scanning for open ports. Find out what your public IP addresses are actually exposing. You may be surprised. We were not surprised to find [Remote Desktop open to the whole internet](/reports/open-rdp-onboarding-discovery) on day one with a new client. It was a leftover from an old project. Nobody remembered it was there. **2. Change the default passwords.** Every HMI, PLC, router, and remote access box. CISA calls out default and easy-to-guess passwords as a common way in. If the password is on a sticker on the cabinet or in the vendor manual, it's not a password. **3. Lock down remote access.** Vendors need to get in. That's fine. CISA says to use a VPN with strong passwords and phishing-resistant MFA, give each person only the access they need, and turn off accounts nobody uses. No port forwards. No "we left it open so the integrator could dial in." **4. Separate the plant from the office.** Put production on its own network segment with a firewall between it and everything else. A phishing click in accounting should not be able to reach the machine running your press. This is the single biggest thing you can do for an old box you can't patch. **5. Know how to run it by hand.** CISA lists keeping the ability to run OT manually as a core mitigation, with fail-safes and recovery plans tested ahead of time. If the network goes down, can your people still run the line? Find out on a slow Tuesday, not during an incident. None of these require replacing equipment. ## How do we handle legacy machines? We keep Windows 98, XP, and 7 machines and SCADA systems running when replacing them isn't realistic. That's most of the time. Our [legacy systems support](/services/legacy-systems) is built around one idea: if you can't fix the box, contain it. Concretely, that means: - **Its own network zone.** The legacy machine goes on a segment with firewall rules that allow only the traffic it actually needs. Air-gapped entirely where the workflow allows. - **Monitoring from the network, not the box.** We watch traffic around the machine instead of installing agents that could destabilize a PC that hasn't seen an update in a decade. - **Nothing changes during production.** Changes get tested off the line, scheduled around your shifts, and come with a rollback plan. - **Settings that stay put.** Windows likes to undo things. We've seen power settings revert after updates and knock screens dark mid-shift. Our [fix for machines that keep going to sleep](/reports/power-profile-always-on) was a kiosk, not a press, but the problem is the same on a plant floor PC that has to stay awake. - **A real upgrade path, on your schedule.** We track the vendor's roadmap. When a sane upgrade exists, we plan it around your capital budget and production calendar, not ours. ## Key takeaways - OT security is about uptime and safety first. Data comes second. - If a machine can't be patched, isolate it. Don't pretend it's a laptop. - Nothing on the plant floor should be reachable from the open internet. - Vendor remote access goes through a VPN with MFA, not a port forward someone set up years ago. - Change every default password on every HMI, PLC, and remote access box. - Know how you'd run the line by hand. Test it before you need it. ## What this looks like when we do it On a new [manufacturing engagement](/industries/manufacturing), we start where an attacker would. We scan your public IP addresses from the outside and close anything that shouldn't be there. That's the day-one work that caught the open RDP above. Then we walk the floor with you. Which machines run old Windows, which ones talk to the office network, how the vendors get in, and what the passwords are on the gear nobody's touched since it was installed. From there we separate production from the office, move vendor access behind a VPN with MFA, change the defaults, and document all of it so you, your auditor, and your insurance carrier can see what's protecting what. We don't tell you to replace a machine that works. We build the walls around it. If your last IT provider wouldn't touch the plant floor, or told you to rip out equipment that still runs, [get in touch](/contact). Fifteen minutes on a call and we'll tell you honestly what we'd do first.