OT security glossary

Clear definitions of the terms used in OT security operations — from the Purdue model to IEC 62443 security levels.

I

IEC 62443: IEC 62443 is a series of international standards for the security of industrial automation and control systems, covering asset owners, system integrators and product suppliers.
Industrial control system (ICS): An industrial control system (ICS) is a combination of control components — such as PLCs, DCS and SCADA — that together monitor and control an industrial process.
Industrial DMZ (IDMZ): An industrial DMZ (IDMZ) is a buffer network between enterprise IT and the OT network, through which all traffic between the two must pass via controlled intermediary systems.

Operational technology (OT): Operational technology (OT) is the hardware and software that monitors and controls physical processes, equipment and infrastructure, such as PLCs, SCADA and distributed control systems.

Passive network monitoring: Passive network monitoring analyses copies of network traffic — taken from SPAN ports or network TAPs — without sending any packets into the monitored network.
Programmable logic controller (PLC): A programmable logic controller (PLC) is a ruggedised industrial computer that reads inputs from sensors and drives outputs such as motors and valves according to a control program.
Purdue model: The Purdue model is a reference architecture that divides industrial networks into levels, from the physical process (level 0) up to enterprise IT (levels 4–5), with an industrial DMZ in between.

Safety instrumented system (SIS): A safety instrumented system (SIS) is an independent control system that brings a process to a safe state when dangerous conditions are detected, designed according to IEC 61511.
SCADA: SCADA (supervisory control and data acquisition) is a system that collects data from remote field devices and lets operators supervise and control geographically distributed processes.
Security operations center (SOC): A security operations center (SOC) is a team, with supporting processes and technology, that continuously monitors an organisation's systems to detect, analyse and respond to cybersecurity incidents.