12. IoT, OT and Cyber-Physical Systems Security

Introduction and Context

The security of connected physical systems differs fundamentally from the security of conventional information technology. A compromised office laptop may expose data or disrupt business processes; a compromised water-treatment controller, railway signalling system, hospital device, or electrical substation may create physical danger, environmental damage, or prolonged loss of essential services. The convergence of information technology (IT), operational technology (OT), the Internet of Things (IoT), and cyber-physical systems (CPS) has therefore expanded cybersecurity from a data-protection concern into a matter of operational resilience and public safety.

IoT devices commonly sense, process, communicate, and sometimes actuate within homes, enterprises, cities, vehicles, and industrial environments. OT refers to systems that monitor or control physical processes, including industrial control systems (ICS), supervisory control and data acquisition (SCADA), distributed control systems (DCS), programmable logic controllers (PLCs), and safety instrumented systems (SIS). A CPS integrates computational, networking, and physical processes through feedback. The distinction between these categories is useful, but their boundaries increasingly overlap. A smart manufacturing line, for example, may contain sensors designed as IoT devices, PLCs and robots managed as OT, cloud analytics hosted in IT environments, and safety functions governed by engineering controls.

Security in such environments must balance confidentiality, integrity, availability, safety, reliability, maintainability, and human factors. Traditional enterprise security often prioritizes confidentiality and rapid patching. OT security generally gives greater weight to deterministic performance, continuous availability, process integrity, and safe operation. A security decision that is sensible for an office network—such as immediately rebooting a server after applying a patch—may be unsafe in a refinery or medical environment.

Learning Objectives

After studying this chapter, students should be able to:

1. Distinguish IoT, OT, ICS, SCADA, CPS, and safety-related systems.

2. Explain why cyber-physical environments require security and safety-aware risk management.

3. Apply the Purdue Enterprise Reference Architecture and IEC 62443 zone-and-conduit concepts.

4. Analyze threats, vulnerabilities, consequences, and dependencies in industrial and critical-infrastructure environments.

5. Design proportionate controls for legacy systems without compromising availability or safety.

6. Evaluate governance, professional, regulatory, and ethical issues in CPS security.

7. Develop a practical response and resilience strategy for an IoT or OT incident.

The Systems Being Protected

IoT, OT and CPS in relation

IoT is a broad term for connected physical objects that collect, exchange, or act on data. Devices may be resource-constrained and widely distributed, and they often depend on mobile applications, wireless networks, manufacturer cloud services, and automated updates. Examples include smart meters, building controllers, connected medical devices, industrial sensors, and vehicle telematics.

OT is concerned with observing and influencing physical operations. Its components include sensors, actuators, PLCs, remote terminal units (RTUs), human-machine interfaces (HMIs), engineering workstations, historians, alarm systems, and control servers. OT protocols such as Modbus, DNP3, OPC UA, PROFINET, EtherNet/IP, and IEC 60870-5-104 differ in security capabilities and operational assumptions. Some older protocols provide little or no native authentication or encryption because they were designed for trusted, isolated networks.

A CPS is characterized by feedback: a sensor measures a physical state, software evaluates the measurement, a controller issues a command, and an actuator changes the physical process. Timing, correctness, and physical consequences matter. A delayed or manipulated signal can be as harmful as a stolen one. CPS security consequently includes temporal integrity, command authenticity, process-state validation, and protection against unsafe control actions.

Safety and security are related but not identical

Safety seeks to prevent accidental harm arising from faults, errors, or hazardous conditions. Security addresses intentional or unauthorized actions, including sabotage, espionage, fraud, and disruption. The two disciplines overlap because a cyberattack can induce a safety incident, while a safety mechanism can limit the consequences of a cyber compromise. They should not, however, be treated as interchangeable. A firewall cannot substitute for an independent emergency shutdown function, and a safety analysis may not consider a maliciously crafted input unless security threats are explicitly included.

Important properties in CPS security include:

• Availability: the system performs its required function when needed.
• Integrity: data, logic, commands, and configurations remain accurate and trustworthy.
• Confidentiality: sensitive operational, personal, or commercial information is protected.
• Authenticity: devices, users, messages, and software are genuine.
• Accountability: actions can be attributed through reliable records.
• Resilience: the process can withstand, recover from, and adapt to disruption.
• Safety: the system remains within tolerable risk limits despite faults or attacks.

A Risk Model for Cyber-Physical Environments

A useful analysis begins with the process rather than the device. The analyst identifies what the process does, which physical states are hazardous, how control decisions are made, and what would happen if measurements, commands, timing, or communications were manipulated. Assets include not only servers and controllers but also recipes, control logic, engineering drawings, credentials, firmware, physical equipment, operators, suppliers, and safety functions.

Threats may be deliberate or accidental. Relevant examples include ransomware, remote access abuse, supply-chain compromise, insecure default credentials, malicious insiders, wireless interference, counterfeit components, engineering errors, and failures caused by unsupported software. Threat actors may include criminal groups, contractors, disgruntled employees, competitors, hacktivists, and state-sponsored teams.

Risk is not simply the presence of a vulnerability. It reflects the interaction among threat, exposure, vulnerability, consequence, and the likelihood of exploitation. Consequence analysis should consider:

1. Human safety: injury, loss of life, or exposure to hazardous conditions.

2. Environmental impact: release, contamination, fire, or ecological damage.

3. Operational impact: loss of production, degraded quality, or unsafe shutdown.

4. Economic impact: recovery costs, penalties, and lost revenue.

5. Societal impact: disruption of energy, water, transport, healthcare, or communications.

6. Information impact: theft of intellectual property, personal data, or sensitive operational information.

A vulnerability with a high technical severity score may deserve lower immediate priority than a modest weakness located on a path to a safety-critical controller. Conversely, an apparently isolated legacy system may be high risk if it is essential to a single point of failure. Risk assessment must therefore be process-aware, dependency-aware, and consequence-driven.

Architectural Models: From Purdue to Zones and Conduits

The Purdue model

The Purdue Enterprise Reference Architecture provides a hierarchical way to understand industrial networks. A simplified interpretation is:

• Level 0: physical process, sensors, and actuators.
• Level 1: basic control devices such as PLCs and RTUs.
• Level 2: supervisory control, HMIs, and local control systems.
• Level 3: site operations, historians, and manufacturing operations management.
• Level 3.5: an industrial demilitarized zone (IDMZ) separating plant operations from enterprise IT.
• Level 4: enterprise services and business systems.
• Level 5: external or internet-connected services.

The model is not a universal description of every modern architecture. Cloud platforms, wireless systems, remote operations, and edge computing may not fit neatly into its levels. Its continuing value is conceptual: it encourages separation of trust, function, and communication paths. Direct, unnecessary connections from enterprise or internet systems to Level 1 controllers should be treated as exceptional and strongly governed.

IEC 62443 and the zone-and-conduit approach

The IEC 62443 family provides a major framework for industrial automation and control-system security. It addresses asset owners, service providers, system integrators, and component manufacturers. Its zone-and-conduit model groups assets with similar security requirements into zones and controls communication between zones through conduits. A zone may contain a production cell, safety system, or supervisory network; a conduit may include controlled network links, firewalls, protocol gateways, or remote-access infrastructure.

Security levels express the capability needed to resist different classes of threat. They are not a simple label applied to an entire plant; requirements should be derived from risk and applied to systems, zones, and components appropriately. IEC 62443 also emphasizes secure product development, system design, identity management, patch management, and operational procedures. In practice, the framework helps an organization move from a flat network to a defensible architecture without assuming that every asset can be replaced.

Defense in depth

No single control is reliable enough for a safety-critical environment. Defense in depth combines architectural separation, least privilege, secure configuration, physical protection, monitoring, backup, recovery, and trained personnel. Controls should be independent where possible. For example, an emergency shutdown should not depend solely on the same network, controller, power supply, or authentication service that could be compromised during an incident.

Security Across the System Life Cycle

Security begins during procurement and engineering, not after installation. A lifecycle approach includes the following activities.

Asset and dependency discovery establishes an authoritative inventory of devices, software versions, communication relationships, owners, and process functions. Passive discovery is often preferable in OT because active scanning may disrupt fragile devices or violate vendor conditions.

Secure design defines zones, conduits, trust boundaries, remote-access paths, data flows, safety independence, and recovery objectives. Threat modelling should include misuse cases such as unauthorized logic modification, falsified sensor readings, denial of control, and manipulation of alarms.

Commissioning and change control verify that device configurations, accounts, network rules, firmware, and control logic match approved baselines. Engineering changes should be tested and documented, with rollback plans.

Operation and maintenance include vulnerability monitoring, backup validation, access reviews, log collection, malware controls, configuration management, and controlled patching. Patching should be based on risk, vendor guidance, testing, maintenance windows, compensating controls, and the consequences of interruption.

Decommissioning removes credentials, certificates, routes, backups, cloud associations, and sensitive data. Abandoned remote-access accounts and forgotten cellular gateways are common sources of residual exposure.

Controls for Legacy and Constrained Environments

Legacy OT presents a central professional challenge. Systems may run unsupported operating systems, use proprietary protocols, lack modern authentication, or require vendor intervention for changes. Replacing them may be financially or operationally impractical. The correct response is not to ignore the weakness or to apply an unsafe enterprise control blindly.

A compensating-control strategy may combine network isolation, allow-list firewalls, unidirectional gateways, jump servers, strict maintenance windows, removable-media controls, application allow-listing, physical restrictions, read-only monitoring, and enhanced logging. A vulnerable PLC should not be exposed directly to the internet merely because it cannot be patched. Similarly, a passive intrusion-detection sensor may be more appropriate than an active vulnerability scanner.

Backups must include controller logic, HMI configurations, historian data, recipes, certificates, network configurations, and documentation. Backups should be offline or otherwise protected from ransomware, periodically restored in a test environment, and associated with known-good process states. Recovery planning should specify who can authorize a shutdown, how manual operation is performed, and how safety is verified before restart.

Identity and remote access deserve particular attention. Shared vendor accounts, persistent VPNs, and unmanaged modems undermine accountability. Preferred practices include named accounts, multifactor authentication where technically feasible, time-limited access, approval workflows, session recording, jump hosts, and immediate revocation after maintenance. Multifactor authentication should be introduced in a way that does not create unsafe delays during emergency operations.

Monitoring, Detection and Incident Response

OT monitoring should combine network observations with process context. Useful signals include unexpected controller-mode changes, new engineering workstations, altered logic, unusual protocol commands, changes in alarm rates, abnormal set points, time synchronization failures, and discrepancies between independent sensors. A security alert becomes more meaningful when correlated with maintenance schedules and physical process conditions.

Incident response requires coordination among cybersecurity, control engineering, safety, operations, legal, communications, and relevant authorities. The first priority is to stabilize the process and protect people. Disconnecting a network segment may be appropriate, but it must be evaluated against the possibility that loss of communication will remove visibility or cause an unsafe state. Teams should know which systems can be isolated, which must remain powered, and how to operate manually.

A mature response process normally includes preparation, detection and analysis, containment, safe eradication, recovery, and lessons learned. Evidence collection must preserve logs and configurations without unnecessarily altering the running system. After recovery, the organization should verify controller logic, firmware, accounts, safety functions, process parameters, and physical equipment—not merely confirm that computers are online.

IoT-Specific Security and Supply-Chain Governance

IoT expands the attack surface through scale, heterogeneity, mobility, and dependence on manufacturers. A device may have limited storage, a long service life, weak update mechanisms, or a cloud service located in another jurisdiction. Procurement should require unique credentials, secure boot where appropriate, signed updates, vulnerability disclosure channels, software bills of materials, supported lifetimes, logging, data minimization, and a documented end-of-life process.

The supply chain includes hardware designers, firmware developers, cloud providers, telecommunications providers, integrators, maintenance contractors, and component distributors. Organizations should define security responsibilities contractually, verify provenance, control software and firmware sources, assess subcontractors, and maintain the ability to revoke trust in a compromised certificate or supplier account. A device that is secure when delivered can become insecure if its cloud service is abandoned or its signing key is compromised.

Applied Case: Ransomware Risk in a Municipal Water Utility

Background

This illustrative case concerns a medium-sized municipal water utility operating treatment plants, pumping stations, laboratory systems, and a customer-services network. The treatment environment contains PLCs, HMIs, a historian, remote telemetry, and a vendor-managed maintenance connection. Some controllers are more than a decade old.

Situation and problem

A contractor’s enterprise email account is compromised. Attackers use it to obtain credentials for a remote-access portal shared by several technicians. They enter the utility network outside a maintenance window, move from an inadequately separated business segment toward the operations environment, and deploy ransomware on engineering workstations. The PLCs continue running, but operators lose some HMI visibility and cannot trust the affected workstations. A simultaneous attempt is made to alter chlorine dosing set points.

Analysis

The immediate risk is not only data encryption. Loss of visibility may prevent operators from detecting unsafe conditions, while unauthorized dosing could create a public-health hazard. The weaknesses include shared accounts, excessive remote-access privileges, insufficient separation between IT and OT, incomplete offline backups, and lack of a tested manual operating procedure. The case also demonstrates why availability, integrity, and safety must be assessed together.

Strategy and solution

The utility first places the process in a stable, locally controlled state and suspends nonessential remote access. Operations and safety personnel verify dosing through independent measurements and use approved manual procedures where necessary. Cybersecurity staff isolate compromised enterprise and engineering segments without disconnecting controllers indiscriminately. The utility preserves forensic evidence, contacts the vendor and relevant authorities, and validates controller logic from known-good records.

After stabilization, the organization redesigns remote access through an IDMZ and managed jump server. Named accounts, multifactor authentication, time-limited approvals, and session logging replace shared persistent access. Passive monitoring is installed on critical segments. Offline backups of PLC programs, HMI images, configurations, and safety documentation are tested. The utility also establishes a joint cyber-safety incident exercise involving operators, engineers, executives, and emergency services.

Outcome

The utility restores trusted engineering workstations and confirms process integrity before returning to normal remote operations. It does not treat restoration of IT systems as evidence that the plant is safe. Longer-term improvements reduce attack paths, improve accountability, and strengthen the ability to operate safely during loss of central visibility.

Learning points

The most significant lesson is that technical containment must be subordinate to process safety. Other lessons are that remote access is a major architectural boundary, backups must be operationally usable, and incident exercises should test manual operation and safety decisions rather than only IT restoration.

Governance, Ethics and Regulation

Operators of essential services have responsibilities extending beyond their own organization. A security failure may affect patients, residents, workers, the environment, and other interconnected services. Governance should assign accountable owners for assets, risks, safety functions, supplier relationships, and incident decisions. Boards and senior leaders should understand that accepting an OT risk is also an operational and sometimes public-interest decision.

Regulatory obligations vary by sector and jurisdiction. Organizations may need to address critical-infrastructure rules, privacy requirements, safety legislation, sectoral standards, breach reporting, records retention, and contractual duties. IEC 62443, the NIST Cybersecurity Framework, NIST guidance for OT security, ISO/IEC 27001, and functional-safety standards such as IEC 61508 may be used together, but none eliminates the need for site-specific engineering judgment.

Ethically, security testing must avoid endangering live processes or exposing sensitive operational information. Researchers and vendors should disclose vulnerabilities responsibly, coordinate with asset owners, and distinguish proof of concept from safe production remediation. Organizations should not conceal material safety risks merely to protect reputation. Privacy also matters in smart buildings, connected vehicles, and workplace monitoring: collecting operational data does not automatically justify collecting identifiable personal data.

Emerging Directions

Industrial edge computing, digital twins, 5G connectivity, autonomous robotics, artificial intelligence, and cloud-based control analytics are increasing capability and complexity. AI can assist anomaly detection, predictive maintenance, alert triage, and configuration comparison. It can also generate false alarms, encode biased assumptions, or be manipulated by poisoned data. AI should support—not silently replace—qualified operational judgment, particularly where actions can affect safety.

Zero-trust principles are being adapted to OT, but they require engineering interpretation. Continuous verification, least privilege, and explicit authorization are valuable; however, constant reauthentication or dependence on a remote identity service may be unsuitable for time-critical or disconnected operations. Secure-by-design regulation and software supply-chain transparency are also becoming more prominent. Future architectures will likely combine local autonomy, stronger device identity, segmented connectivity, cryptographic integrity, and more formal evidence of safety and security claims.

Best-Practice Principles

A defensible IoT and OT program should:

• begin with process consequences and safety requirements;
• maintain an accurate asset, dependency, and data-flow inventory;
• segment networks using risk-based zones and controlled conduits;
• minimize direct IT, internet, and vendor paths to control systems;
• use passive discovery and carefully tested changes in fragile environments;
• establish secure, monitored, time-limited remote access;
• protect and regularly restore offline backups;
• integrate cyber incident response with safety and emergency procedures;
• manage suppliers, firmware, certificates, and end-of-life commitments;
• measure recovery capability through realistic exercises; and
• treat security, safety, reliability, and human expertise as interdependent.

Chapter Summary

IoT, OT, and CPS security protects connected computational and physical processes whose failures may cause operational, economic, environmental, or human harm. OT differs from conventional IT because deterministic performance, availability, process integrity, and safety are often dominant requirements. Effective assessment begins with the process and its consequences, not merely with device vulnerabilities. The Purdue model helps visualize hierarchy and trust boundaries, while IEC 62443 uses risk-based zones and conduits to structure industrial security. Defense in depth, lifecycle governance, passive monitoring, controlled remote access, tested backups, and safety-aware incident response are essential, especially where legacy systems cannot be replaced. Strong governance must include suppliers, regulators, engineers, operators, and public-interest responsibilities. Emerging technologies offer improved visibility and automation but introduce new dependencies and must remain subject to human and safety oversight.

Key Terms

Cyber-physical system: A system in which computational and networking functions monitor and influence physical processes through feedback.

Internet of Things (IoT): A network of physical objects capable of sensing, processing, communicating, or acting through digital connectivity.

Operational technology (OT): Hardware and software used to monitor or control physical processes.

Industrial control system (ICS): An integrated set of control technologies used in industrial operations.

SCADA: Supervisory Control and Data Acquisition; an architecture for monitoring and controlling geographically distributed processes.

PLC: Programmable Logic Controller, a ruggedized controller executing industrial control logic.

HMI: Human-Machine Interface used by operators to observe and interact with a process.

Purdue model: A hierarchical reference architecture for relating enterprise, operations, control, and physical-process levels.

Industrial DMZ: A controlled intermediary network separating enterprise IT from plant operations.

Zone: A group of assets with similar security requirements in the IEC 62443 approach.

Conduit: A controlled communication path connecting zones.

Safety instrumented system: An independent or specially engineered system that places a process in a safe state when hazardous conditions arise.

Defense in depth: The use of multiple complementary and partially independent security controls.

Compensating control: An alternative safeguard used when a preferred control cannot reasonably be implemented.

Process integrity: Confidence that physical operations, parameters, logic, and commands remain correct and trustworthy.

Passive monitoring: Observation of network or system activity without actively probing or altering devices.

Digital twin: A computational representation of a physical asset or process used for analysis, simulation, or monitoring.

Software bill of materials: A structured record of software components and dependencies in a product.

Review Questions

Short Answer Questions

1. Why can a conventional IT patching practice be unsafe in an OT environment?

2. Distinguish safety from security in a cyber-physical system.

3. What functions are commonly associated with Purdue Levels 0, 1, and 2?

4. Define a zone and a conduit in IEC 62443.

5. Why are passive discovery techniques often preferred in legacy OT networks?

Long Answer Questions

1. Explain the security characteristics of IoT, OT, and CPS and analyze how their risks overlap.

2. Discuss how the Purdue model and IEC 62443 can be used together in designing a segmented industrial architecture.

3. Develop a lifecycle security strategy for a water-treatment facility containing legacy PLCs.

4. Explain why cyber incident response in critical infrastructure must integrate cybersecurity, operations, and safety personnel.

5. Evaluate the governance and supply-chain responsibilities of an organization deploying connected industrial devices.

Analytical / Application Questions

1. A factory has internet-connected vendor access directly to an engineering workstation and no offline controller backups. Identify the principal risks and propose a prioritized remediation plan.

2. During a suspected attack, an operator loses HMI visibility while local PLC control continues. What technical and safety decisions should the response team make before disconnecting systems?

3. A hospital plans to deploy thousands of connected infusion pumps. Construct a risk-based assessment covering device identity, updates, network segmentation, privacy, supplier dependency, and safe fallback operation.

22. Multiple Choice Questions with Answers

Question 1

Which characteristic most clearly distinguishes cyber-physical system security from conventional enterprise information security?

A. It focuses exclusively on confidentiality.

B. It must account for the physical consequences and timing of manipulated data or commands.

C. It eliminates the need for human operators.

D. It requires every device to be connected to the public internet.

Correct Answer: B. It must account for the physical consequences and timing of manipulated data or commands.

Question 2

In a Purdue-oriented architecture, what is the principal purpose of an industrial DMZ?

A. To place safety controllers directly on the internet.

B. To replace all PLCs with cloud services.

C. To mediate and control exchanges between enterprise IT and plant operations.

D. To provide unrestricted remote access for vendors.

Correct Answer: C. To mediate and control exchanges between enterprise IT and plant operations.

Question 3

Under the IEC 62443 zone-and-conduit approach, a conduit is best understood as:

A. A group of assets with identical physical functions.

B. A controlled communication path between security zones.

C. An emergency shutdown device.

D. A software bill of materials.

Correct Answer: B. A controlled communication path between security zones.

Question 4

Why might passive monitoring be selected instead of active vulnerability scanning in a legacy OT network?

A. Passive monitoring guarantees that no vulnerability exists.

B. Active scanning can disrupt fragile devices or time-sensitive processes.

C. Passive monitoring encrypts all industrial protocols automatically.

D. Active scanning is prohibited in every industrial environment.

Correct Answer: B. Active scanning can disrupt fragile devices or time-sensitive processes.

Question 5

A vulnerable PLC cannot be patched without invalidating its vendor support. Which response is most appropriate?

A. Expose the PLC directly to the internet so it can be monitored.

B. Ignore the vulnerability because the PLC is old.

C. Use proportionate compensating controls such as segmentation, restricted access, monitoring, and tested recovery.

D. Disable all safety functions until replacement is funded.

Correct Answer: C. Use proportionate compensating controls such as segmentation, restricted access, monitoring, and tested recovery.

Question 6

During an OT ransomware event, what should normally receive the highest immediate priority?

A. Restoring executive email first.

B. Protecting people and stabilizing the physical process.

C. Deleting all logs to prevent data leakage.

D. Reconnecting every remote-access account.

Correct Answer: B. Protecting people and stabilizing the physical process.

Question 7

Which backup practice provides the strongest resilience against ransomware affecting engineering systems?

A. Keeping the only backup permanently mounted on the production network.

B. Backing up only office documents.

C. Maintaining protected offline copies of logic, configurations, and process documentation and testing restoration.

D. Relying exclusively on vendor memory of the original configuration.

Correct Answer: C. Maintaining protected offline copies of logic, configurations, and process documentation and testing restoration.

Question 8

Why is a high technical vulnerability score not by itself sufficient to prioritize an OT remediation?

A. Technical scores are never useful.

B. OT risk also depends on process consequences, exposure, dependencies, and safety impact.

C. All OT vulnerabilities have identical consequences.

D. Only confidentiality matters in OT.

Correct Answer: B. OT risk also depends on process consequences, exposure, dependencies, and safety impact.

Question 9

Which remote-access design best supports accountability and risk reduction in an industrial environment?

A. A shared, permanent vendor password.

B. An unmanaged modem available at all times.

C. Named accounts, approval, multifactor authentication where feasible, time limits, and session monitoring.

D. Direct access from a vendor laptop to Level 1 controllers.

Correct Answer: C. Named accounts, approval, multifactor authentication where feasible, time limits, and session monitoring.

Question 10

What is a key limitation of applying zero-trust principles mechanically to OT?

A. Least privilege is never useful in OT.

B. Continuous dependence on remote authentication may conflict with disconnected or time-critical operations.

C. Zero trust requires eliminating network segmentation.

D. Zero trust applies only to physical locks.

Correct Answer: B. Continuous dependence on remote authentication may conflict with disconnected or time-critical operations.