What is security?
Security is the combination of organisational, physical and technical measures that protects people, assets, information and processes against deliberate threats such as intrusion, sabotage, theft, malware and hacking. In the context of IT and OT, it is mainly about cybersecurity: protecting networks, control systems and data against digital attacks. Security is therefore different from safety, which protects people, machines and the environment against unintentional hazards such as failures and human error. In a factory or utility the two are inseparable: a successful attack on a controller can turn directly into a safety incident.
🔄 What is the difference between security and safety?
Dutch, like English, has two words: beveiliging means security and veiligheid usually means safety. In everyday Dutch, however, “veiligheid” is also used for security, which regularly causes confusion in international projects.
| Aspect | Security | Safety |
|---|---|---|
| Protects against | Deliberate threats: attackers, sabotage, criminals | Unintentional hazards: failures, wear, human error |
| Core question | Can someone misuse the system? | Can the system harm someone? |
| Typical standards | IEC 62443, ISO 27001, NIS2 | IEC 61508, IEC 61511, NEN-EN-ISO 13849 |
| Risk analysis | Cybersecurity Risk Assessment, threat analysis | HAZOP, LOPA, machinery risk assessment |
| Threat evolves | Yes, attackers adapt | Hardly; physics and failure rates are largely stable |
| Measure of strength | Security Level (SL 1–4) | SIL (1–4) |
The classic distinction “unintentional versus deliberate” has become too black and white. Since edition 2 of IEC 61511 (2016), a security risk assessment is required for every safety instrumented system, and the Machinery Regulation (EU) 2023/1230 requires from 20 January 2027 that control systems withstand reasonably foreseeable malicious attempts that lead to a hazardous situation. Security has thus become a precondition for safety.
🧱 What forms of security are there?
- Physical security — fences, access badges, CCTV and locked cabinets and server rooms. Anyone who can physically reach a PLC or switch bypasses many digital controls.
- Information security — protecting information in any form, on paper or digital, organised through an ISMS in line with ISO 27001 and ISO 27002.
- Cybersecurity — protecting networks and systems against digital attacks, worked out for industry in IEC 62443.
- Personnel security — screening, security awareness and protection against social engineering and phishing.
ISO 27001:2022 reflects this split: the 93 controls in Annex A are grouped into four themes, namely organisational (37), people (8), physical (14) and technological (34).
🎯 What are the goals of security: CIA or AIC?
ISO/IEC 27000, the vocabulary standard underpinning ISO 27001, defines information security as the preservation of confidentiality, integrity and availability, the CIA triad. In OT the order is reversed, which is why practitioners there often speak of AIC.
| Priority | Office IT | OT / industrial automation |
|---|---|---|
| 1 | Confidentiality (preventing data breaches) | Safety of people and the environment |
| 2 | Integrity | Availability: the process runs 24/7 |
| 3 | Availability | Integrity of control data and measurements |
| 4 | — | Confidentiality (recipes, process data) |
In OT the focus is therefore on the continuity of production, the integrity of setpoints and measured values, and preventing harm to people, the environment, reputation and the economy. In a chemical plant, a manipulated measurement is more dangerous than a leaked document.
⚠️ Which threats are typical for OT?
| Threat | Example in OT |
|---|---|
| Ransomware | Halting production by encrypting HMI/SCADA systems |
| Supply chain risk | Manipulation of firmware or software via suppliers |
| Remote Access misuse | Unauthorised access to a PLC over unprotected connections |
| Man-In-The-Middle | Attacks on communication between SCADA and field devices |
| Phishing | Social engineering aimed at engineers or operators |
| Replay Attack | Replaying valid commands to drive machines again |
| Rogue Device | An unauthorised device placed in a network segment |
Two incidents made the link between security and safety visible. Stuxnet (discovered in 2010) manipulated PLCs to damage centrifuges while operators saw normal values. TRITON (2017) targeted a Triconex safety system at a Saudi petrochemical plant, the first known malware aimed specifically at a SIS; the attack was discovered because the system tripped the plant into a safe shutdown.
🔐 Which principles form the basis of security?
| Principle | Meaning |
|---|---|
| Defense in Depth | Multiple independent layers (physical, network, system, application, organisation) |
| Least Privilege | Granting only the access that is strictly necessary |
| Zero Trust | No implicit trust based on network location; verify every access (NIST SP 800-207, 2020) |
| Security by Design | Building security in from the design stage rather than adding it afterwards |
| Segregation of duties | Separating functions between roles and authorisations |
| Asset visibility | Knowing what is running through Asset Inventory and Asset Discovery |
| Logging and monitoring | Recording and analysing anomalies, incidents and attempts |
| Response and recovery | Prepared incident response procedures and backups |
IEC 62443 translates these principles into seven foundational requirements: identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability. For each requirement the Security Level determines how strong the measures must be, from SL 1 (casual or coincidental violation) to SL 4 (attackers with extended resources and OT-specific skills).
🔧 Which security measures are used in OT?
| Category | Measure or technique |
|---|---|
| Network security | Firewall, NAC, 802.1X, Port Security, VLAN, network segmentation |
| Endpoint security | Whitelisting, Antivirus, EDR, patch management |
| Authentication and access | MFA, RBAC, Access Control, Jump Server |
| Detection and logging | SIEM, anomaly detection, IDS/IPS, Syslog |
| Management and governance | Security Awareness, ISMS, Risk Management, Backup |
| Standards and legislation | IEC 62443, NIS2, ISO 27001, Cyber Resilience Act |
🛠️ How does OT security differ from IT security?
| Aspect | IT security | OT security |
|---|---|---|
| Priority | Confidentiality and integrity | Safety and availability |
| System characteristics | Dynamic, frequently patched | Legacy, 24/7, 15–25 year lifespan |
| Consequence of an attack | Data breach, fraud | Process disruption, sabotage, physical damage |
| Change policy | Agile, CI/CD | Via MOC or planned maintenance |
| Patching | Monthly, automated | After vendor approval and during a shutdown |
The differences between IT and OT explain why IT controls cannot be copied one-to-one to the plant floor. An active network scan or an automatic reboot after an update can make a controller hang. With OT convergence, both worlds therefore need one shared security policy with OT-specific exceptions.
🏛️ Who is responsible for security?
Security is not a job for the IT department alone. NIS2 (Article 20) and the Dutch Cybersecurity Act (Cyberbeveiligingswet), which entered into force on 15 August 2026, place final responsibility with the management body: the board must approve the measures, oversee their implementation and undergo training itself.
| Role | Responsibility |
|---|---|
| Board / management | Set risk appetite, approve measures, liable in case of negligence |
| CISO | Security strategy, security policy and reporting to the board |
| OT security lead / plant manager | Translation to the plant floor, alignment with safety and maintenance |
| Asset owner | Risk assessment and measures per installation, as intended by IEC 62443-2-1 |
| Suppliers and integrators | Secure products and services in line with IEC 62443-4-1 and IEC 62443-2-4 |
A well-designed governance model links these roles to an ISMS and to the organisation’s wider risk management.
⚖️ Is compliance the same as security?
No. Compliance means demonstrably meeting laws and standards; security is the actual resilience against attacks. An organisation can hold an ISO 27001 certificate and still be vulnerable in its OT, because the plant was outside the certified scope. Conversely, good security usually produces the strongest evidence for compliance. Relevant frameworks in the Netherlands and the EU are the Cybersecurity Act (an estimated 8,000 organisations, early warning of a significant incident within 24 hours), the Cyber Resilience Act for manufacturers (reporting obligations from 11 September 2026, full application from 11 December 2027), the Machinery Regulation and, for Dutch government bodies, the BIO.
✅ How do you approach security in an OT environment?
- Map your assets — build an asset inventory of all PLCs, HMIs, servers and network components.
- Carry out an OT risk assessment — combine it with the existing HAZOP so that security and safety scenarios align.
- Segment — divide the network using the zones and conduits model from IEC 62443-3-2 and the Purdue Model, applying segmentation at every level.
- Secure access — protect remote access with a jump server and MFA, and apply least privilege.
- Control change — verify updates through code signing and patch management, and route every change through MOC.
- Detect and respond — put monitoring in place and draw up an Incident Response Plan with OT-specific scenarios.
- Train and improve — run awareness training and measure progress with a maturity model.
❓ Frequently asked questions
Is security the same as cybersecurity?
No, security is broader than cybersecurity. Security also covers physical, personnel and information security, whereas cybersecurity specifically concerns protecting networks, systems and data against digital attacks.
What is the difference between security and safety?
Security protects against deliberate threats such as attackers and sabotage. Safety protects people, machines and the environment against unintentional hazards such as failures and human error. In OT the two are linked, because a cyberattack can cause a safety incident.
Why does availability take priority over confidentiality in OT?
In OT, software controls physical processes that often run 24/7, where downtime or manipulation leads directly to danger or major damage. OT security therefore follows the order safety, availability, integrity and only then confidentiality, while office IT traditionally puts confidentiality first.
Which standard do you use for security in OT?
The main standard for OT security is IEC 62443, which sets requirements for asset owners, integrators and suppliers of industrial automation. Many organisations use ISO 27001 for the surrounding management system, and NIST SP 800-82 Rev. 3 (2023) is a widely used supplementary guide.
Does a safety instrumented system (SIS) need to be secured as well?
Yes, a SIS needs to be secured as well. Since edition 2 (2016), IEC 61511 requires a security risk assessment of the safety instrumented system, and the TRITON attack of 2017 showed that attackers really do target SIS controllers.
Who is ultimately responsible for security in an organisation?
Under NIS2 and the Dutch Cybersecurity Act, the board is ultimately responsible for security. Management must approve the measures, oversee their implementation and undergo training itself, while the CISO and OT leads carry out the work.
📌 In summary
Security protects people, plants, information and OT systems against deliberate threats and has become a precondition for safety in industry. A secure OT environment requires visibility, segmentation, monitoring and resilience, with clear responsibilities at board level and attention to both technology and human behaviour.