Securing operational technology requires a fundamentally different approach to IT security. OT environments face a growing and sophisticated threat landscape — and Australian operators now face binding legislative obligations to protect their critical infrastructure systems.
OT cyber security is the practice of protecting operational technology — the industrial control systems that monitor and run physical processes, including SCADA, DCS, PLCs, RTUs and safety instrumented systems. It differs from IT security in what it protects first: availability and safety, because a compromised OT system can stop a production line, contaminate water, black out a grid, or injure people.
In Australia, OT cyber security is no longer discretionary for critical infrastructure. The Security of Critical Infrastructure (SOCI) Act imposes binding risk management, reporting and — for systems of national significance — enhanced obligations on operators across energy, water, transport, communications and data.
OT threats have evolved from opportunistic IT attacks spilling over into industrial networks to sophisticated, OT-specific campaigns deliberately targeting physical infrastructure. The consequences extend well beyond data loss.
OT-targeted ransomware encrypts historian databases, engineering workstations, and SCADA servers — forcing operators to shut down production or operate blind. The 2021 Colonial Pipeline attack halted fuel supply to the US East Coast via an IT-to-OT impact chain.
State-sponsored groups such as XENOTIME (Triton/TRISIS malware targeting Safety Instrumented Systems), Volt Typhoon, and Sandworm have demonstrated both capability and intent to attack critical infrastructure OT for espionage and pre-positioned destructive access.
OT assets running decade-old firmware and unsupported operating systems carry persistent known vulnerabilities that cannot be quickly patched. CVEs affecting SCADA software and PLC firmware remain unpatched for years in live production environments.
Malicious firmware or software introduced at the manufacturing stage, or through vendor remote access connections, can provide persistent and hard-to-detect access to OT environments. Third-party maintenance accounts are a recurring attack vector.
Authorised personnel — operators, maintenance engineers, contractors — hold privileged physical and logical access to OT systems. Access management in OT is often immature, with shared accounts, weak passwords, and no MFA on critical engineering workstations.
Increasing connectivity between IT and OT networks — via business intelligence feeds, IIoT sensors, and vendor remote access — eliminates the isolation that historically protected OT, without necessarily adding the compensating security controls to replace it.
OT cybersecurity in Australia is no longer a matter of best practice. Operators of critical infrastructure face binding legislative obligations with significant penalties for non-compliance.
Australia's operational technology footprint is concentrated in resources, energy, water and transport — sectors where a control system failure has immediate physical and public consequence. The regulatory obligations above apply differently depending on the sector and the asset class.
Iron ore operations in the Pilbara and coal operations in the Bowen Basin run some of the most heavily automated OT estates in the country: autonomous haulage, remote operations centres in Perth and Brisbane controlling sites hundreds of kilometres away, conveyor and processing plant control, and rail loadout systems. Remote operations centres concentrate control of many sites into one network, which raises the consequence of a single OT compromise and makes IT/OT separation a first-order design question.
LNG trains on the North West Shelf and at Gladstone, offshore platforms, and downstream refining and terminal operations depend on DCS and safety instrumented systems where the consequence of manipulation is measured in lives rather than downtime. The Triton/TRISIS attack demonstrated that safety systems in exactly this kind of facility are a deliberate target. Oil refinery IT/OT projects typically centre on segmenting process control networks from enterprise IT while preserving the production data flows the business depends on.
Grid operators are covered by both the SOCI Act and the AESCSF. High renewable penetration has added large numbers of inverter-based resources and distributed control endpoints to networks originally designed around a small number of synchronous generators — expanding the OT attack surface and the number of parties with remote access into it.
Water utilities operate geographically dispersed SCADA estates with hundreds of remote sites connected over radio, cellular and leased links. Treatment plant control, chemical dosing and pump station telemetry are safety-relevant: the 2000 Maroochy Shire incident in Queensland remains one of the most-cited OT attacks worldwide, and dosing systems are an obvious target for anyone seeking physical consequence.
Rail technology combines signalling and interlocking systems, traction power control, level crossing protection and increasingly IP-based train control. Safety certification makes change slow and patching constrained, so rail IT/OT work is dominated by segmentation, monitoring and compensating controls rather than by patching legacy assets. Ports, freight terminals and traffic management systems face comparable constraints.
Plant-floor PLC and HMI estates, often assembled over decades from multiple vendors, with limited asset inventory and flat networks. Manufacturing is the sector most frequently hit by OT-affecting ransomware globally — usually not because the OT itself was targeted, but because an IT compromise forced a precautionary production shutdown.
Multiple frameworks guide OT security programs. IEC 62443 is the most comprehensive and OT-specific. These frameworks are complementary rather than competing.
The primary international standard for OT security. A multi-part series covering general concepts, security management systems, system design, component requirements, and evaluation methodology. Defines a risk-based zone-and-conduit architecture and five security levels (SL 0–4). Referenced by Australia's AESCSF and recommended by the ACSC as the preferred technical standard for OT environments. Applicable to asset owners (Series 2), system integrators (Series 3), and product manufacturers (Series 4). See iec62443.au for a detailed reference guide to all published parts and security levels.
Published by the US National Institute of Standards and Technology, SP 800-82 provides guidance on how to secure ICS — including SCADA, DCS, and PLC systems — while considering the performance, reliability, and safety requirements unique to OT environments. A widely cited companion to IEC 62443 and a foundation for many national OT security frameworks internationally, including elements of the AESCSF.
Mandatory cybersecurity standards for the North American bulk electric system, developed by the North American Electric Reliability Corporation. While not directly applicable in Australia, NERC CIP standards — particularly for electronic security perimeters, physical security, systems security management, and incident reporting — are widely referenced by Australian energy sector operators for OT security best practice.
The Network and Information Security 2 Directive extends EU cybersecurity obligations significantly, covering 18 critical sectors and explicitly requiring supply chain security. Australian operators with European operations, supply chains, or products sold into Europe face NIS2 obligations. The Directive references IEC 62443 for OT environments and has driven increased vendor-level OT security requirements globally.
Effective OT security is built on a small number of high-impact foundations. These principles apply regardless of sector, system scale, or maturity level — and directly support SOCI Act and IEC 62443 compliance.
You cannot secure what you cannot see. Comprehensive OT asset visibility — including firmware versions, network connections, and communication flows — is the non-negotiable foundation. Passive discovery tools are preferred to avoid disrupting OT devices.
Implement zone-and-conduit architecture per IEC 62443-3-2. Separate OT from IT using industrial DMZs and firewalls. Apply data diodes at boundaries where unidirectional data flow is sufficient. Air gaps where operationally feasible.
Assess OT assets continuously for known vulnerabilities. Prioritise by risk and operational impact. Where patching is not feasible — due to lifecycle or vendor constraints — apply layered compensating controls: network isolation, application allow-listing, monitoring.
Enforce least-privilege for all OT users. Implement MFA for all remote access paths, including vendor connections. Regularly audit and remove unused accounts. Eliminate shared credentials on critical engineering workstations and SCADA servers.
Deploy passive, OT-aware monitoring tools that understand industrial protocols (Claroty, Dragos, Nozomi Networks, or similar) and can detect anomalous behaviour without disrupting operations. Feed alerts into an OT-aware SOC or SIEM with OT context.
Develop OT-specific incident response playbooks that explicitly account for the safety implications of isolating or shutting down OT systems. Test response capability through regular tabletop exercises that include both IT and OT stakeholders.
Direct answers to the questions most often asked about securing operational technology in Australia.
OT cyber security is the practice of protecting operational technology — the industrial control systems that monitor and control physical processes, including SCADA, DCS, PLCs, RTUs, HMIs and safety instrumented systems. It differs from IT security in its priority order: OT security protects safety and availability first, because a compromised control system can halt production, damage equipment, disrupt essential services such as water or power, or endanger people. Techniques routinely used in IT security, such as active vulnerability scanning and immediate patching, can themselves disrupt OT devices and must be adapted before use.
Australian OT security obligations are set principally by the Security of Critical Infrastructure (SOCI) Act 2018, administered by the Cyber and Infrastructure Security Centre within the Department of Home Affairs. Responsible entities for critical infrastructure assets must adopt a critical infrastructure risk management program, report cyber incidents to the Australian Signals Directorate, and maintain an asset register. Assets declared systems of national significance carry enhanced cyber security obligations. The electricity and gas sectors additionally use the Australian Energy Sector Cyber Security Framework (AESCSF) for maturity assessment, and the Australian Cyber Security Centre publishes ICS-specific guidance.
The sectors with the largest operational technology exposure in Australia are mining and resources (iron ore in Western Australia, coal in Queensland, both heavily automated and increasingly run from remote operations centres in Perth and Brisbane), oil and gas including LNG and refining, electricity generation, transmission and distribution, water and wastewater utilities, rail and transport, and manufacturing and food processing. Most of these fall within critical infrastructure sectors covered by the SOCI Act.
The primary cybersecurity threats to OT environments include: ransomware targeting critical infrastructure (demonstrated by Colonial Pipeline 2021 and multiple water utility incidents); nation-state actors targeting OT for espionage and pre-positioning (Volt Typhoon, XENOTIME/Triton); supply chain compromise through vendor firmware or software updates; insider threats from authorised personnel with physical or logical OT access; legacy vulnerabilities in long-lived OT assets that cannot be patched; and boundary erosion as IT/OT convergence eliminates historical air-gap protections.
The Security of Critical Infrastructure (SOCI) Act 2018, most recently amended by the Enhanced Response and Prevention Act 2024, requires Australian critical infrastructure operators to: implement a Critical Infrastructure Risk Management Program (CIRMP) covering all hazards including cyber; report significant cyber incidents to the Australian Cyber Security Centre (ACSC) within 12 hours of becoming aware; notify the government of system outages within 12 hours; maintain board-level accountability for cybersecurity; and provide the government with step-in powers during serious incidents. Non-compliance attracts civil penalties up to AUD 11 million for corporations. The Act explicitly addresses OT and interconnected systems.
IEC 62443 is the international standard series for securing Industrial Automation and Control Systems (IACS). It is the most widely recognised OT-specific cybersecurity framework globally and is referenced by Australia's SOCI Act requirements and AESCSF as the preferred technical standard for OT security controls. IEC 62443 addresses all three stakeholder groups — asset owners, system integrators, and product manufacturers — and defines a risk-based, zone-and-conduit security architecture with five security levels. See iec62443.au for a comprehensive reference guide.
The Australian Energy Sector Cybersecurity Framework (AESCSF) is a sector-specific cybersecurity framework developed for electricity and gas operators by the Australian Energy Market Operator (AEMO) and the energy industry. It provides a risk-tiered maturity model based on the NIST Cybersecurity Framework, supplemented with OT-specific guidance and alignment to IEC 62443. Electricity generators, network operators, and retailers are expected to complete AESCSF assessments. The framework directly supports compliance with SOCI Act obligations for energy sector participants.
The six foundational OT security principles are: (1) Asset Inventory — comprehensive visibility of all OT assets including firmware versions and network connections; (2) Network Segmentation — zone-and-conduit architecture per IEC 62443-3-2 with industrial DMZs; (3) Vulnerability Management — continuous assessment with risk-based prioritisation and compensating controls where patching is not feasible; (4) Access Control — least-privilege, MFA for remote access, regular access reviews; (5) Monitoring and Detection — passive OT-aware monitoring using protocol-aware tools; (6) Incident Response — OT-specific playbooks that account for safety implications of isolation decisions.
Need specialist OT security advice for your critical infrastructure environment? Get in touch ↗