Skip to content
OT Daily BriefIndustrial cyber intelligence
Weekly brief
THE INDUSTRIAL CYBER ATLASCONTEXT BEFORE CONSEQUENCE
An interactive field guide

Understanding
OT.

Behind every signal,
there is a physical world.

Explore the systems that move our world, the attacks that changed them, and the boundaries that protect them.
Explore the turning points Enter the architecture
SYSTEM VIEW / L2 → L1 → L0
  1. L2HMI / supervisory control
  2. L1PLC / basic control
  3. L0Physical process
Simplified, conceptual view. Commands descend L2 → L1 → L0; feedback returns upward. Functional levels are not network connections.System reduced motion pauses by default. Toggle Pause to stop or resume; your explicit choice is remembered.
Energy. Water. Manufacturing. Everyday life.Scroll to discover
01 / THE ORIGINS

A newer name.
Decades of control.

OT stands for operational technology: programmable systems and devices that monitor or change the physical environment. The term unites a world that existed long before its name.

01Before the label

Control came first.

Industrial automation, PLCs and distributed control systems predate today’s OT vocabulary. Their job was already physical: keep processes stable, available and safe.

02The 2000s onward

A shared language emerged.

Operational technology became an umbrella for systems that monitor or change the physical world. ICS is part of OT; building automation and transportation systems belong here too.

03The connected plant

The boundary changed.

Ethernet, remote maintenance and business integration created useful connections—and new dependencies. Security must account for the process behind every asset.

IT works with information. OT acts on the world.The NIST perspective
02 / THE TURNING POINTS

The threat evolved.
So did the stakes.

Seven turning points: incidents, a disclosed capability and direct exposure. Distinguish reported outcomes from potential consequences. Select a year to investigate what happened, why it mattered and what it teaches us.

CASE ARCHIVE 01 / 07
Nuclear enrichmentIran

Discovered 2010

Incident

Simplified case path · not a network reconstruction

Stuxnet: individual equipment diagram1. Removable media / Windows, L2/3. 2. Specific Siemens S7 logic modified, L1. 3. Frequency converters / centrifuges, L0. Concealment at L2: operators saw replayed normal process data while the real process behaved abnormally. Equipment is schematic, not a model-specific reconstruction.Replayed normal values to operators1Windows / Step 7L2/32Specific Siemens S7 PLCsL13Drives / centrifugesL0
  1. 1
    Removable media / WindowsL2/3Engineering workstation · Step 7
  2. 2
    Specific Siemens S7 logic modifiedL1Targeted controller and drive configurations
  3. 3
    Frequency converters / centrifugesL0Speed changes and equipment damage

Concealment at L2: operators saw replayed normal process data while the real process behaved abnormally.

Reported physical sabotage
CASE FILE / Stuxnet

Code crosses into the physical world.

Discovered in 2010, Stuxnet targeted specific Siemens S7 controllers and drive configurations. Compromised Step 7 engineering software modified PLC logic and concealed abnormal behavior from operators.

L1 controller target · delivered through L2/L3 engineering systems

Symantec · W32.Stuxnet Dossier / publisher update

Selected historical cases, not an exhaustive or live threat feed. Dates identify discovery, incident or disclosure as described. Architecture links are educational mappings; animated paths are conceptual illustrations.

03 / INSIDE THE ARCHITECTURE

One plant.
Many trust boundaries.

Explore a common Purdue-based view, from enterprise systems to the physical process. Select a level to discover its devices, dependencies and defensive priorities.

THE PURDUE EXPLORER
BUSINESS CONTEXTPHYSICAL CONSEQUENCE
Data moves up. Decisions influence the process below.
LEVEL 1 / Industrial OT

Basic control

Controllers execute logic close to the process, reading inputs and driving outputs on strict operational cycles.

WHAT LIVES HERE
PLCsRTUsDCS controllersSafety controllers*
Modbus · PROFINET · EtherNet/IP · DNP3 · S7Comm · OPC UA
THE EXPOSURE

Changed logic or setpoints can alter equipment behavior. DCS controllers and safety controllers are conceptually L1, but belong in separate zones. Safety controllers need independent protection.

THE DEFENSIVE PRIORITY

Control programming access, baseline logic and monitor controller mode and configuration changes.

IN CONTEXT

Stuxnet targeted control logic; TRITON targeted a separate safety function.

A reference model, not a guarantee of segmentation. Real plants vary. Remote access, cloud connections and IIoT can cross levels. Safety systems need separate zones; engineering stations may span levels 2–3. The industrial DMZ is commonly shown as “3.5.” Validate actual zones and conduits against your process and ISA/IEC 62443 requirements. Read the NIST guidance

04 / THE FIELD GUIDE

Know the device.
Understand the consequence.

Different roles. Different failure modes. Explore six building blocks of an industrial environment.

Executes / TYPICAL LEVEL 1

Programmable logic controller

Runs control logic, reads sensor inputs and commands actuators. Built for predictable, repetitive operation.

ON THE PLANT FLOOR

Starts a pump when a tank reaches a defined level.

WHAT TO WATCH

Logic changes, programming access and unexpected mode changes.

THE OPERATIONAL PERSPECTIVE

The asset is digital.
The stakes are physical.

Start with the process. Understand the dependencies.
Protect the people and systems that keep it running.

Read today’s intelligence Explore CISA ICS advisories
KEEP EXPLORING

Built on evidence.

Primary references for the definitions, architecture and case studies in this guide. Each incident links to its own source.

NIST SP 800-82 Rev. 3OT definitions, architectures, threats and security practices.NCSC · OT malwareHow industrial malware interacts with the physical world.MITRE ATT&CK for ICSA common language for adversary behavior in industrial systems.
Context. Evidence. Operational relevance.Back to the beginning ↑