OT Cybersecurity Glossary
Industrial cybersecurity: IEC 62443, the Purdue model, firewalls, DMZ, zero trust, and OT threats. 74 terms in this topic - each defined in plain English on its own page.
Securing a control system is not the same job as securing an office network: availability outranks confidentiality, patching windows are rare, and equipment lifetimes run to decades. These definitions cover the OT security architecture vocabulary (zones and conduits, DMZs, data diodes, the Purdue model), the defensive controls (segmentation, allowlisting, secure remote access, PKI), and the threat and detection language used by frameworks like IEC 62443 and NIST SP 800-82. Terms here describe defensive concepts only.
74 Terms
What Is Aggressive Mode in DNP3 Secure Authentication?
An SAv5 variant that bundles the HMAC into the request to skip the challenge round-trip, kept safe by a sequence number.
Read → GlossaryAlarms are firing but nothing changed: why?
Trust the operators and suspect the measurement or the setup: a bad reading, a wrong limit, or chatter.
Read → GlossaryEvery tag flatlined at once: what broke?
Map the scope of the flat to name the shared element: a stopped poll, a dead device, or a frozen link.
Read → GlossaryWhat Is Anomaly Detection?
Flagging readings that deviate from learned normal - statistical and model-based methods, and how it differs from alarms.
Read → GlossaryWhat Is an APN Whitelist for SCADA SIMs?
Restricting a private-APN SIM to the SCADA host range only, blocking exfiltration and runaway data usage.
Read → GlossaryWhat Is Application Allowlisting in OT?
Locking HMIs and engineering workstations to a fixed set of approved executables, blocking everything else by default.
Read → GlossaryWhat Is Attribute-Based Access Control?
Deciding access from attributes like role, device, location, time, and work order rather than static roles.
Read → GlossaryWhat is audit log forwarding in SCADA?
Streaming the user and config audit trail to an external SIEM or archive so records survive independently.
Read → GlossaryWhat Is a Certificate Authority in OT?
The trusted issuer that signs device certificates for RTUs, PLCs, and HMIs, and why plants run a private CA.
Read → GlossaryWhat Is Certificate Pinning in OT?
Locking a device to one exact certificate or key to block man-in-the-middle, and the rotation trade-off.
Read → GlossaryWhat Is Certificate Revocation in OT?
How and why a cert is killed before expiry, plus CRL vs OCSP checking and the OT connectivity problem.
Read → GlossaryWhat is CIP Security?
The ODVA extension adding authentication, integrity, and confidentiality so CIP connections resist spoofing and tampering.
Read → GlossaryWhat is a Security Configuration Baseline?
The documented known-good hardened settings a device is measured against, and how drift is caught.
Read → GlossaryWhat Is Cryptographic Key Rotation in OT?
Periodically replacing keys to limit exposure, with graceful overlapping rollover so field assets stay online.
Read → GlossaryData Diode
A hardware device that physically enforces one-way data flow out of an OT network, letting monitoring data leave while blocking any return path.
Read → GlossaryWhat Is Defense in Depth in OT?
The layered strategy of stacking independent controls so one failure never exposes the industrial process.
Read → GlossaryWhy is my control valve hunting?
Split the causes with the manual-mode test, then read the trend shapes: tuning, stiction, positioner instability, or oversizing.
Read → GlossaryHow do you roll out DNP3 secure authentication?
Inventory support, design key management first, stage enablement in waves, and verify with authentication-failure statistics.
Read → GlossaryDNP3 Secure Authentication
Authenticating critical requests against spoofing and replay with SAv5.
Read → GlossaryWhat is DNS tunneling detection in OT?
Catching data smuggled inside DNS queries by watching query volume, entropy, and subdomain length against a quiet baseline.
Read → GlossaryWhat is a dual-homed device in an OT network?
A host with two NICs on different networks; safe as a data broker, dangerous if it silently bridges your segments.
Read → GlossaryWhat Is EST Certificate Enrollment?
How RFC 7030 lets field devices automatically request and renew certificates from a CA, versus legacy SCEP.
Read → GlossaryA field site went dark: where do you start?
A symptom-first triage tree that splits power from comms from device before you dispatch a truck.
Read → GlossaryWhat Is a Hardware Security Module in OT?
A tamper-resistant appliance that generates and stores CA and signing keys so they never exist in software.
Read → GlossaryIEC 62351 Security
The standard that retrofits authentication and encryption onto IEC 61850 and 60870-5.
Read → GlossaryIEC 62443 parts map: which part covers what
The four groups of the IEC 62443 series and the parts people actually cite, indexed by role so you find the right document fast.
Read → GlossaryIEC 62443 roles: owner, integrator, supplier
The three shared-responsibility roles in the series, what each owns, the parts each answers to, and where security gaps appear at the handoffs.
Read → GlossaryIEC 62443 SL 1 to 4: what each defends against
The four security levels explained by the attacker each withstands, from casual violation at SL 1 to a well-resourced adversary at SL 4.
Read → GlossaryIEC 62443 SL-T vs SL-A vs SL-C explained
The three flavors of security level, target, capability, and achieved, what each answers, and how you drive the achieved level to meet the target.
Read → GlossaryWhat Is IT/OT Convergence?
The merging of business IT and plant-floor OT - unlocking operational data while demanding careful segmentation.
Read → GlossaryWhat is security event correlation across IT and OT?
Linking a phishing hit in IT with new OT traffic to reconstruct the lateral-movement timeline a silo would miss.
Read → GlossaryWhat is a Jump Host in OT?
The single hardened server every remote session must pass through before reaching a control device.
Read → GlossaryWhat Is Just-in-Time Access in OT?
Granting privileges only for a bounded window then auto-revoking, ending standing admin access.
Read → GlossaryWhat is Least Privilege in OT?
Granting each account only the access it needs, and why shared engineering logins break the principle.
Read → GlossaryWhat is Multi-Factor Authentication in OT?
Why a second factor matters most on OT remote-access paths, and the hurdles of shared consoles and offline sites.
Read → GlossaryModbus Security Posture and Mitigations
Why plain Modbus has no authentication or encryption, and the layered defenses that help.
Read → GlossaryWhat is MQTT TLS and client certificate authentication?
How TLS encrypts an MQTT link and how mutual TLS with per-device client certificates gives stronger identity than a shared password.
Read → GlossaryWhat Is Mutual TLS in OT?
Both client and server present certificates so a rogue device cannot impersonate a legitimate RTU.
Read → GlossaryWhat Is NAT/Firewall Traversal?
Why carrier-grade NAT hides remote sites and how telemetry reaches devices behind it - explained.
Read → GlossaryWhat is Network Access Control in OT?
Controlling which devices may connect to a switch port so a rogue laptop plugged into OT is blocked.
Read → GlossaryWhat Is Network Segmentation in OT?
Dividing an OT network into isolated segments so a problem in one part cannot spread across the whole plant.
Read → GlossaryWhat is on-device anomaly detection at the edge?
Lightweight checks on the gateway that flag abnormal readings locally, even when the backhaul is down.
Read → GlossaryWhat Is Operational Technology (OT)?
The hardware and software that monitors and controls physical processes - the world of PLCs, RTUs, and SCADA.
Read → GlossaryWhat is alert triage in an OT SOC?
How analysts enrich, deduplicate, and prioritize a flood of OT alerts by process impact so a real intrusion is not buried.
Read → GlossaryWhat is a decoy asset or deception grid in OT?
Seeding a control network with fake PLCs, honeytokens and credentials so any interaction proves an intruder is present.
Read → GlossaryWhat is an OT honeypot such as Conpot?
A decoy emulating a PLC or Modbus device to lure and record attackers, sitting safely off the real control network.
Read → GlossaryWhat is an OT network baseline for anomaly detection?
Learn who-talks-to-whom on which protocol, then flag deviations, using the determinism of control traffic.
Read → GlossaryWhat is threat hunting in OT networks?
Hypothesis-driven search for a hidden intruder, using the deterministic nature of control traffic to shrink dwell time.
Read → GlossaryWhat is Out-of-Band Management in OT?
Administering OT network gear over a separate dedicated channel so admin traffic never shares the production data path.
Read → GlossaryWhat Is an Outbound-Only Connection?
Device-initiated links that reach cloud SCADA with no open inbound ports - and their security upside - explained.
Read → GlossarySome tags from a site work and some don't: why?
Survivors prove the site is up, so draw the boundary: a second controller, a network segment, a power branch, or one interface.
Read → GlossaryWhat is passive network monitoring in OT security?
Receive-only sensing that fingerprints assets and catches intrusions without sending a packet that could crash a PLC.
Read → GlossaryHow Does Patch Management Work in OT?
Why control systems cannot follow IT's monthly cadence, and how validation and downtime windows shape patching.
Read → GlossaryWhat is a patch window in OT?
A scheduled, approved slot to update a live plant, aligned with production and bracketed by backup and verification.
Read → GlossaryWhat is the difference between physical and logical network segmentation in OT?
Physical separation uses its own switches and cabling; logical uses VLANs and firewall zones. Compare and layer them.
Read → GlossaryWhat is protocol whitelisting in OT security?
A deny-by-default posture that allows only the protocols a segment needs, turning any unexpected one into an alert.
Read → GlossaryWhat Is the Purdue Model?
The layered reference architecture that segments industrial networks from field devices to enterprise IT.
Read → GlossaryWhat is Removable Media Control in OT?
How sanitization kiosks and USB port lockdown stop malware entering air-gapped sites through drives.
Read → GlossaryWhat is Role-Based Access Control in SCADA?
Structuring SCADA permissions by job role instead of per-user, the mechanism that implements least privilege.
Read → GlossaryWhat Is Secure Boot on a PLC?
Each firmware stage is cryptographically verified before it runs, so tampered code refuses to boot.
Read → GlossaryWhat Is a Security Baseline in OT?
The approved secure configuration a device must match, derived from vendor and benchmark guidance.
Read → GlossaryWhat Is a Security Level in IEC 62443?
The SL 1-4 rating scale and how target, achieved, and capability levels drive per-zone controls.
Read → GlossaryWhat Is an OPC UA Security Policy Like Basic256Sha256?
A named bundle of signing, encryption, and key-exchange algorithms - current ones vs deprecated SHA-1-based policies.
Read → GlossaryWhat is a SIEM correlation rule for OT?
Logic that stitches a failed login, a firmware upload, and an off-hours setpoint change into one high-confidence alert.
Read → GlossaryWhat Is the Difference Between OPC UA Sign and SignAndEncrypt Modes?
Sign gives integrity and authenticity in the clear; SignAndEncrypt adds confidentiality - a separate choice from policy.
Read → GlossaryWhat is signature vs behavioral detection in an OT IDS?
Matching known ICS exploits versus modeling normal behavior to catch novel attacks, and why both run together.
Read → GlossaryWhat is a SOAR playbook for OT incidents?
How a playbook chains enrichment and containment for OT while keeping the steps that could trip a plant human-approved.
Read → GlossaryWhat Is a Split-Tunnel VPN for Remote Sites?
Sending only SCADA host traffic through the tunnel while other traffic breaks out locally, saving cellular bandwidth.
Read → GlossaryWhat is syslog forwarding from OT devices?
How switches, firewalls and RTUs emit syslog, why UDP 514 loses events, and how a collector ships logs reliably.
Read → GlossaryWhat is a Unidirectional Security Gateway?
A protocol-replicating one-way device that exports SCADA data to IT while blocking any return path.
Read → GlossaryWhat is Virtual Patching in OT?
Shielding an unpatchable device at the network layer so a known exploit is blocked without touching it.
Read → GlossaryWhat Is a VPN Tunnel?
The encrypted, encapsulated connection that secures remote telemetry across public networks - IPsec and outbound designs.
Read → GlossaryVPN, private APN, or data diode?
Choose by direction and exposure: a VPN for two-way access you harden, a private APN for less-exposed two-way cellular, a diode for one-way monitoring-only assurance.
Read → GlossaryWhat Are Zones and Conduits (IEC 62443)?
The IEC 62443 model of grouping OT assets into security zones and controlling traffic between them through conduits.
Read →Automation services
Need help turning this into a working system?
Merobix integrates SCADA, programs Allen-Bradley and Siemens PLCs, and designs and fabricates industrial control panels.
Meeting requests are reviewed before confirmation.
Keep Reading
All Glossary Topics
Browse the full 21-topic automation glossary.
Read Article → Deep DiveAir-Gapped SCADA Security Guide
Isolation architectures and their real trade-offs.
Read Article → Deep DiveAI Anomaly Detection for OT Security
How behavioral baselines catch what signatures miss.
Read Article → GuideSCADA Security Glossary Guide
The security vocabulary of SCADA, in one narrative guide.
Read Article →