ICS Security: A Complete Guide to Protecting Critical Industrial Systems
The Claroty Team
/April 16th, 2025/
13 min read
Revised date: April 15, 2025
With the ongoing convergence of IT and operational technology (OT), the industrial sector has undergone a massive transformation in the way it protects industrial processes. OT networks and industrial control systems (ICS) equipment that were previously air-gapped and isolated from IT and the internet are now connected to them, further expanding the footprint of these cyber-physical systems (CPS). In an ideal world, this convergence boosts production processes through connected ICS by enabling real-time data analysis, predictive maintenance, and data sharing.
However, this transformation is not without its risks. As these systems and equipment are brought online, they each are assigned an IP address. This exposes each newly connected device to cyberattacks and expands an organization’s potential attack surface. What’s more, many components of ICS are often supported by outdated legacy technology, which wasn’t designed with connectivity or modern security threats in mind.
Using the right cybersecurity strategy, organizations can:
Protect ICS and OT networks
Increase productivity and efficiency
Minimize risk to physical processes and the business
In this guide, we’ll explore how to secure OT and ICS in order to ensure the safety, availability, and reliability of physical processes, especially those deemed critical infrastructure and core to our national and economic security.
The Role of Industrial Control Systems in Critical Infrastructure
Industrial control systems are the cyber-physical systems that control and automate industrial processes. These processes are prevalent in various critical infrastructure industries including chemical, electric, oil & gas, manufacturing, transportation and more.
ICS include a number of components up and down the Purdue Model for ICS such as sensors and actuators at Level 0 that feed information to programmable logic controllers (PLCs) and remote terminal units (RTUs) at Level 1, that are managed at the control layer, Level 2. These components work together to monitor and control various process-oriented systems, such as temperature, pressure, flow rate, and other variables.
What are Examples of Industrial Control Systems?
Supervisory Control and Data Acquisition (SCADA)
SCADA systems, for example, provide control at the supervisory level. It allows industrial organizations to control processes locally or at remote locations, monitor, gather, and process real-time data, interact with devices such as sensors, valves, pumps, motors, and more through HMI software, and record events into log files. SCADA systems are primarily used for long distance monitoring and control of field sites through centralized control systems. They are commonly found in industries such as pipeline monitoring and control, water treatment centers and distribution, and electrical power transmission and distribution.
These systems allow asset operators in said industries to automate day-to-day tasks—giving them the ability to monitor and control field sites without having to travel long distances. There are several advantages to SCADA systems such as cost reduction, flexibility, and performance efficiency; however, the threats against these systems have risen greatly in recent years due to increased remote access and internet connectivity.
Building management systems (BMS) are another common example of ICS. BMS are computer-based control systems that are used to monitor and regulate various aspects of building systems. The goal of building management systems is to guarantee the safety of facility operations and to optimize performance and reduce energy consumption of these systems. Examples of BMS include HVAC systems, lighting systems, energy management systems, security systems, fire and life safety systems, and elevator and escalator systems. This form of ICS is designed to improve overall operational efficiency, the comfort of building occupants (which many times includes patients in healthcare delivery organizations (HDOs)), and safety — while reducing operating costs and environmental impact.
Much like SCADA systems, cyberattacks to BMS can result in a wide variety of issues ranging in severity. Attacks can lead to a shutdown of or tampering with critical manufacturing processes, theft of valuable enterprise data, or even go as far as a compromise of the safety of patients in a hospital. These two examples only scratch the surface of the different types of ICS used in various industries. But, they all have one thing in common, the need to be protected against the inherent challenges they face with a comprehensive ICS security strategy.
What are the Challenges of Securing ICS?
Industrial control systems suffer from five major challenges that leave them vulnerable to cyberattacks:
1. IT/OT Convergence Expands OT Attack Surface
A great challenge faced by industrial control systems is the convergence of IT and OT. IT and OT systems have historically been managed separately, with different teams responsible for each area. As organizations become more reliant on interconnected systems, there has been a growth toward convergence of these two areas. Although IT/OT convergence provides organizations with greater integration and visibility of their supply chain, this interconnectivity also increases the attack surface of OT systems and increases the potential for exploits targeting newly connected systems. Additionally, the OT infrastructure in many organizations is poorly protected against cyberattacks. This is due to the fact that traditional IT security tools can’t be used to protect OT environments, because they have the potential to interfere with critical processes which may lead to loss of production or, even worse, cause physical harm to operators or the public.
2. Legacy Systems Lack Cybersecurity Capabilities
Another major issue ICS faces is the abundance of legacy technology in industrial environments. Many industrial control systems were built decades ago, without security or connectivity in mind, and many times lack necessary cybersecurity capabilities, such as encryption and authentication, to protect them against modern, advanced cyberattacks. Asset owners and operators are caught between the need to maintain physical safety as well as system availability and reliability, and the need to lock down these systems against cyberattacks. Any changes to legacy technologies could impair industrial processes, requiring a strategic approach maintaining availability while reducing an organization’s attack surface. Organizations must consider a host of options, including compensating controls in order to mitigate vulnerabilities and reduce exposure to threats such as ransomware and other exploits.
3. Secure Access Fights off Illicit Attempts to Exploit Vulnerabilities
Many industrial control systems lack sufficient access controls, making it easier for threat actors to gain unauthorized access, either directly or through third-parties who are authorized to access critical systems. Managing this exposure is crucial for asset owners and operators, many of whom must extend access to vendors and technology partners for maintenance or support of industrial assets. Third-party users can be especially difficult to support because they typically cannot share jump servers or other infrastructure, which can be costly and complex for administrators. Poor visibility of these third-party connections and other remote sessions puts organizations at risk of remote attacks.
Many industrial environments have no tolerance for downtime, and maintenance windows are a rarity. Yet with connectivity, organizations must identify, prioritize, mitigate, and remediate software and firmware vulnerabilities within industrial control systems and protocols. This impacts how often patches are deployed, many of which are made readily available by vendors. Industrial enterprises often are exposed for long periods of time as software vulnerabilities remain unpatched or firmware flaws are not updated. Once again, compensating controls play a key strategic role here in mitigating exposures in internet-facing technology until a patch or firmware update is applied.
5. Advanced Attackers Understand ICS Exposures
Industrial control systems are often targeted by sophisticated cyberattacks, such as advanced persistent threats (APTs), ransomware, and other extortion-based attacks. APT actors such as Sandworm have developed custom-made tools for targeting ICS and their attacks are designed to remain undetected for long periods of time. China’s Volt Typhoon, meanwhile, has embedded offensive weapons in U.S.-based critical infrastructure, likely in order for them to be activated in the event of military conflict. Other attacks such as the 2021 Colonial Pipeline incident can not only damage your organization, but they can also have drastic implications for the economy and consumer confidence. Attackers understand how exposed ICS and OT is, and the hesitancy to update these critical systems in a timely fashion. Companies are exposed for longer periods, and must keep a vigilant eye on the activities of these groups, and understand whether their threat models include APTs and other advanced actors.
Essential ICS Cybersecurity Measures for Industrial Protection
Now that we’ve addressed the major challenges faced by industrial control systems, it’s time to learn how to protect them. This starts with implementing an ICS security strategy that ensures the protection and integrity of your critical infrastructure — and teaming up with the right cyber-physical systems (CPS) security vendor to help. Here’s where to begin.
Asset Inventory Foundational for ICS Security
The first step to reduce risk and to boost cyber resilience in your connected ICS environments is to establish an in-depth asset inventory. You can’t protect what you can’t see — which is why asset inventory is the foundation of any good ICS security strategy. A CPS security vendor such as Claroty, can help your organization gain a comprehensive and fully automated asset inventory, giving you in-depth asset visibility. This granular visibility is key in identifying the diverse mix of new and legacy devices in ICS environments, and in recognizing the proprietary protocols used by OT, BMS, and other industrial assets that are invisible to generalized security tools.
Once comprehensive enterprise-wide visibility is established, it can enable so much within a security program focused on resilience. Many programs are centered on vulnerabilities, but boiling an ocean of CVEs is untenable for most organizations. Instead, an exposure management approach based on a scoped-out asset inventory can help organizations reduce risk based on numerous factors including known exploited vulnerabilities, insecure connectivity, poor access controls, insecure protocol usage, and much more. By narrowing down remediation strategies to the most at-risk systems based on this approach, an enterprise can keep the highest-risk systems safe while gathering resources to address remaining issues.
Claroty can help your critical infrastructure organization banish this barrier with exposure management capabilities that automatically correlate your critical assets with vulnerability and risk information. We can then prioritize remediation efforts based on how critical the risk is to your operations and impact to safety. Claroty drives actions to enhance your risk posture by identifying and implementing the right compensating controls. We also safely eliminate blindspots with integrations to ensure that your organization is protected from even the most advanced attacks.
OT Network Segmentation Ensures Cyber Resilience
Once the identification of vulnerabilities and remediation of risks takes place, Claroty can then help sustain cyber resilience with effective network segmentation. Beginning a segmentation program for your unique environment can prove difficult when determining which policies to define and how, as well as which technologies to use to enforce those policies. Claroty solves this challenge by using our domain expertise to recommend segmentation policies that can easily and automatically be enforced via existing infrastructure to protect your environment. By enforcing granular access controls for remote internal and third-party users, we can help your organization ensure secure remote access.
The next step in ensuring cyber resilience is threat detection. Claroty offers purpose-built monitoring that can detect all manner of threats impacting industrial environments. Through the rise of interconnectivity and advancement of digital transformation, we’ve seen that cyberattacks are increasing in frequency and sophistication. Our platform solves this challenge by easily identifying and remediating attack vectors with a clear indication of potentially threatening activity in your environment. By alerting on potential malicious activity, we can define and enforce policies to prevent future violations — even those committed by APT actors. We also possess the capability to streamline threat alerting and minimize false positives. The inherent complexity of new and legacy devices, systems, and processes in industrial environments makes threat monitoring uniquely prone to false positives. With Claroty, you can automatically weed out these false positives, and consolidate all interrelated events into one single alert.
Frameworks Guide Cybersecurity Strategies
In addition to aiding your organization in the protection of its critical ICS, Claroty solutions are purpose-built to help organizations comply with cybersecurity frameworks, regulatory requirements, industry guidelines, and other security standards such as ISA/IEC 62443 — a critical series of standards adopted by the International Electrotechnical Commission (IEC) .
Following a cybersecurity framework can provide critical infrastructure organizations like yours with a comprehensive approach for managing your cybersecurity risks. Developed by the National Institute of Standards and Technology (NIST), the NIST Cybersecurity Framework (CSF) is an example of a cybersecurity framework that provides organizations with guidelines, best practices, and standards for a flexible and risk-based approach to managing and improving their cybersecurity posture. By seeking out a CPS solution provider to help your organization align with regulatory frameworks such as NIST CSF, you will reap the benefits of a strengthened cybersecurity posture, improvement of risk management strategies, and the proper guidance when it comes to industry best practices.
Similarly, implementing reference models such as the Purdue Model can help organizations limit the scope of what an adversary can do or access within their converged enterprise. A strong network architecture, similar to that of the Purdue Model, improves overall ICS cybersecurity and provides a foundation for additional security measures to be incorporated over time. By partnering with a CPS security provider like Claroty, organizations can successfully implement concepts such as the Purdue Model to ensure the success of their industrial control systems cybersecurity strategy.
Collaborating for Stronger ICS Security
Guarding your industrial control systems from cyberattacks is no easy feat. The implementation of a successful ICS security framework is even more dire due to the fact that these cyberattacks not only have financial repercussions but can have detrimental impact on human health and safety. As hackers increasingly take advantage of the fundamental challenges faced by industrial organizations, it is more important than ever to gain a full picture of the critical assets in your environment. From there, your team can use this strong foundation to implement successful strategies around exposure management, network protection, and threat detection. By teaming up with the right CPS security vendor, you can empower your industrial control systems cybersecurity strategy and ensure cyber and operational resilience.
