OT Security Basics: Operational Technology and Ukraine's Infrastructure Defense

Operational technology (OT) encompasses the hardware and software that monitors and controls physical industrial processes—electric grids, pipelines, water treatment plants, railway control systems, and manufacturing facilities. Unlike traditional information technology (IT) systems that process data, OT systems directly interact with the physical world: adjusting voltage on power lines, opening and closing valves, controlling train switches. This physical interaction creates safety-critical dependencies that conventional IT security measures do not adequately address. Ukraine has been at the center of the most consequential OT cyberattacks in history, making its experience the most important real-world case study for OT security practitioners worldwide.

IT/OT Convergence and Emerging Risks

Historically, OT systems were isolated from enterprise IT networks and the internet—the "air gap" provided security through physical separation. The drive for operational efficiency, remote monitoring capabilities, and data integration has progressively eroded this separation. Modern industrial sites increasingly connect historians, human-machine interfaces (HMIs), and supervisory control and data acquisition (SCADA) systems to enterprise networks and, increasingly, to cloud analytics platforms. Each integration point creates a potential pathway for attackers to move from the enterprise network into OT environments. Ukraine's 2015 and 2016 power grid attacks demonstrated this pathway in practice: attackers compromised enterprise networks, pivoted to OT-adjacent systems, and ultimately manipulated distribution control systems to cause manual power outages affecting hundreds of thousands of customers.

OT Security Architecture: The Purdue Model

Ukraine's OT Attack History

The December 2015 attack on Ukraine's power grid—attributed to Sandworm, a Russian military intelligence (GRU Unit 74455) threat actor—was the first confirmed cyberattack to cause a physical power outage. Attackers compromised three regional distribution companies, used customized malware (BlackEnergy 3) to map and access OT systems, remotely operated distribution substation breakers, and deployed KillDisk to wipe infected systems during the attack to impede recovery. The 2016 repeat attack used the Industroyer/Crashoverride malware—the first malware designed specifically to speak industrial control protocols (IEC 104, IEC 61850, DNP3) to directly control substation equipment without relying on HMI software. The 2022 Industroyer2 attack, discovered and disrupted by CERT-UA and ESET, represented an upgraded version designed for the same purpose—suggesting persistent capability development by Sandworm against Ukrainian power infrastructure across seven years.

IEC 62443 and OT Security Standards

The IEC 62443 international standard series, developed collaboratively by the International Society of Automation (ISA) and the International Electrotechnical Commission (IEC), provides a structured framework for industrial automation and control system cybersecurity. The standard defines security levels (SL 1-4) based on the sophistication of attack the system must resist, from casual/opportunistic threats (SL 1) to state-sponsored adversaries with OT-specific capabilities (SL 4). Ukraine's critical infrastructure operators have been working toward IEC 62443 compliance with support from Western partners, though wartime conditions—including attacks on physical infrastructure, personnel shortages, and supply chain disruptions—have complicated systematic standards implementation. ENISA and EU partners have provided frameworks and training to assist Ukrainian operators.

Practical OT Security in Wartime Conditions

Ukraine's OT security challenge is compounded by conflict conditions: physical damage to facilities creates situations where security controls must be rebuilt alongside operations; skilled OT security professionals are scarce and some have been mobilized; Russian forces in occupied areas have had direct physical access to OT installations including substations and gas metering stations. Practical resilience measures that Ukraine and its partners have emphasized include: manual operation readiness—ensuring operators can control critical processes without electronic systems—as a fallback that renders cyberattack impact temporary rather than catastrophic; redundant communications independent of primary network paths; enhanced authentication for remote access to OT systems; and passive monitoring solutions that detect anomalous behavior in OT network traffic without imposing the availability risks of active scanning.

FAQ

What is the difference between IT and OT security?

IT security prioritizes confidentiality, integrity, and availability (CIA triad) of data. OT security prioritizes safety, availability, and then integrity. OT systems often run legacy software that cannot be easily patched, have very high availability requirements (downtime is measured in physical impact), and interact with physical processes where a security failure can cause injuries or deaths.

What was Industroyer malware?

Industroyer (also known as Crashoverride) was malware discovered in 2016 designed specifically to manipulate industrial control systems in electric substations. Unlike previous cyberattacks that used OT access to operate HMI software, Industroyer communicated directly with substation equipment using native ICS protocols, representing a significant advancement in industrial cyberattack sophistication.

What is an air gap in OT security?

An air gap is the physical isolation of a network (no wired or wireless connections to external networks). In OT environments, air-gapped networks historically provided strong security. However, pure air gaps are increasingly rare due to operational needs, and attackers have demonstrated techniques to bridge air gaps via removable media, supply chain compromises, and compromised peripherals.

What is IEC 62443?

IEC 62443 is an international standards series covering cybersecurity for industrial automation and control systems (IACS). It provides a risk-based framework for system owners, integrators, and product manufacturers, defining security levels, segmentation requirements, and security lifecycle processes for OT environments.

How can operators defend OT systems during active conflict?

Key measures include maintaining manual operation capability as a fallback; network segmentation between IT and OT with monitored jump servers; enhanced logging and traffic monitoring in OT networks; strict removable media controls; and vendor/remote access management. Coordinating with national CERTs for threat intelligence on active OT-targeting campaigns is essential for wartime operations.

Sources

1. Dragos, "CRASHOVERRIDE: Analyzing the Malware that Attacks Power Grids," June 2017
2. ESET, "Industroyer2: Industroyer reloaded," April 2022
3. ICS-CERT, "Ukraine Power Grid Attack Analysis," 2016
4. ISA/IEC 62443 Standards Series, 2020 editions
5. CISA, "Identifying and Protecting Against OT Threats," 2022