Cybersecurity area
OT / IoT
OT / IoT security provides visibility, segmentation, and protection for industrial, operational, specialized, and connected devices outside the classic IT model.
Acronym Glossary
This glossary explains acronyms used in this part so the intended security function is clear.
- OT
- Operational TechnologyTechnology that controls physical processes in manufacturing, energy, transport, or industrial environments.
- IoT
- Internet of ThingsConnected devices and sensors that communicate over a network and often do not follow a classic endpoint management model.
- SIEM
- Security Information and Event ManagementCollection, normalization, correlation, and analysis of security events from multiple sources.
- IDS
- Intrusion Detection SystemA system for detecting suspicious or malicious network activity without directly blocking traffic.
What This Area Covers
OT / IoT covers industrial systems, control technologies, sensors, cameras, medical devices, building systems, specialized devices, and assets that often do not behave like standard IT endpoints. These environments are sensitive to availability, operational safety, device lifecycle, and production impact.
Why It Matters
The biggest challenges in OT and IoT are often incomplete inventory, weak segmentation, legacy protocols, supplier access, and limited ability to install agents. That is why asset discovery, protocol-aware firewalls, industrial IDS, OT SIEM, IoT device control, and secure isolated access are important. The goal is not only to detect attacks, but also to protect availability and operational stability.
How To Navigate This Area
OT and IoT environments cannot simply copy standard IT approaches. The priorities are passive asset identification, protocol awareness, secure supplier access, minimal operational impact, and the ability to communicate risk between IT, OT, and operations management. Availability, human safety, and device lifecycle context matter.
The design must respect operational reality. In many cases, passive monitoring is safer than active scanning. Protocol knowledge, the ability to distinguish normal process traffic from risky behavior, secure supplier access, and the connection of IT and OT views into one manageable model are essential.
The technology list below works as a map of the OT / IoT area. The practical sequence is to name the security problem first, select the closest technology category second, and only then compare relevant vendors. This helps separate similar-sounding solutions and reduces the risk of adding another tool without a clear architectural role.
Technical Section Schema
Questions To Ask When Selecting A Solution
- Which OT or IoT assets are critical for production, operations, or services?
- Can agents be deployed, or is passive monitoring required?
- How is remote access for suppliers and service teams handled?
- Where are the boundaries between IT, OT, IoT, and operational team responsibility?
- Does the security team have OT context and protocol knowledge?
How To Use This Section
Each technology page expands one category, explains its architectural role, and lists SecTec portfolio vendors related to that area. The section page is therefore the orientation layer, while the detail pages support concrete mapping to solutions.
Vendors From The SecTec Portfolio
Attack coverage and defensive context
MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.
Practical attack scenarios
- Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
- Malware and Command and ControlMalicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
- Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
- Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
- Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
- Reconnaissance and attack surface mappingAn adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
- Defense evasion and control impairmentAn adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
- DDoS and resource exhaustionAn adversary floods a network, application, API, or endpoint and exhausts capacity, connections, or compute resources to reduce service availability.
Relevant ATT&CK techniques
- T1018 · Remote System DiscoveryDetect, Prevent, Respond, Validate
- T1021 · Remote ServicesDetect, Prevent, Respond
- T1040 · Network SniffingDetect, Prevent, Respond, Validate
- T1046 · Network Service DiscoveryDetect, Prevent, Respond, Validate
- T1071 · Application Layer ProtocolDetect, Prevent, Respond
- T1133 · External Remote ServicesDetect, Prevent, Respond
- T1210 · Exploitation of Remote ServicesDetect, Prevent, Respond
- T1498 · Network Denial of ServiceDetect, Respond
- T1499 · Endpoint Denial of ServiceDetect, Respond
- T1595 · Active ScanningDetect, Validate
- T1686 · Disable or Modify System FirewallDetect, Prevent