The Monitoring Gap in Industrial Cybersecurity
Most organizations that operate industrial control systems already have a Security Information and Event Management (SIEM) platform monitoring their enterprise IT environment. When the mandate arrives to extend cybersecurity monitoring to OT, the natural assumption is that the existing SIEM can simply be expanded to cover industrial systems.
That assumption is wrong, and acting on it creates a dangerous false sense of security.
IT SIEM platforms are designed to ingest Windows event logs, firewall logs, Active Directory events, and application telemetry. They correlate events using rules built around IT attack patterns: failed login attempts, suspicious file downloads, lateral movement between endpoints. These are valuable capabilities for IT networks, but they fundamentally miss the threats that matter most in OT environments.
Why IT SIEM Falls Short in OT
1. No Industrial Protocol Awareness
The most critical communications in an OT environment happen over industrial protocols: Modbus TCP, DNP3, EtherNet/IP, OPC UA, PROFINET, and dozens of proprietary vendor-specific protocols. An IT SIEM sees these as opaque TCP/UDP flows. It cannot parse the payload, cannot distinguish a legitimate control command from a malicious one, and cannot detect protocol-level anomalies that indicate an attack targeting the physical process.
When a Modbus write command changes a process setpoint from 150 to 1500, an IT SIEM sees a normal TCP session on port 502. An OT-aware monitoring platform sees a potentially dangerous parameter change that could cause equipment damage or a safety event.
2. No Asset Context
IT SIEMs categorize assets as servers, workstations, and network devices. OT environments contain PLCs, RTUs, HMIs, engineering workstations, safety controllers, historians, and dozens of device types that do not exist in IT taxonomies. Without understanding what a device is, what process it controls, and what its normal communication pattern looks like, a SIEM cannot generate meaningful alerts for OT.
A PLC that suddenly starts communicating with a device it has never contacted before is a significant security event. An IT SIEM has no baseline to detect this anomaly.
3. No Process Context
The most sophisticated OT attacks do not look like IT attacks. They look like legitimate engineering activity. An attacker who gains access to an engineering workstation and modifies PLC logic is performing the same operations a maintenance engineer performs daily. Detecting the difference requires understanding the process context: Is there a maintenance window scheduled? Is this change authorized? Does the new logic deviate from the approved baseline?
IT SIEM platforms have no concept of process context, maintenance schedules, or control logic baselines.
4. Volume and Noise
OT networks generate telemetry at different rates and patterns than IT networks. A single SCADA polling cycle can generate thousands of periodic read operations per minute that are completely normal. Feeding this raw data into an IT SIEM overwhelms the correlation engine with noise, buries real alerts in false positives, and drives up licensing costs based on events per second.
What Effective OT Monitoring Requires
Protocol-Aware Deep Packet Inspection
Effective OT monitoring must decode industrial protocols at the application layer. This means parsing Modbus function codes, DNP3 data objects, CIP services, and OPC UA node values. Only with protocol-aware inspection can the monitoring system detect:
- Unauthorized write commands to PLCs or RTUs
- Firmware upload or download operations outside maintenance windows
- Configuration changes to safety-critical parameters
- Protocol violations that indicate scanning or fuzzing activity
- Function codes that should never appear in normal operation
Asset-Centric Behavioral Baselines
OT monitoring must build and maintain a model of every communicating device: what it is, what it talks to, what protocols it uses, and what its normal communication patterns look like. Alerts should be generated when behavior deviates from this baseline:
- New device appears on the network
- Existing device communicates with a new destination
- Device uses a protocol it has not used before
- Communication volume or timing deviates significantly from established patterns
- Device firmware version changes
Process-Aware Detection Logic
The most mature OT monitoring programs incorporate process context into their detection logic:
- Control logic change detection: monitoring PLCs for unauthorized logic modifications
- Setpoint deviation monitoring: alerting when process values move outside expected ranges
- Operational state awareness: adjusting detection sensitivity based on whether the process is in startup, normal operation, shutdown, or maintenance mode
- Safety system monitoring: dedicated detection rules for any changes to Safety Instrumented Systems
OT-Specific Threat Intelligence
OT monitoring platforms should incorporate threat intelligence specific to industrial environments:
- Known OT malware signatures (TRITON, Industroyer, PIPEDREAM/INCONTROLLER)
- Indicators of compromise from OT-specific threat actors (CHERNOVITE, ELECTRUM, XENOTIME)
- Vulnerability exploitation patterns for common OT devices
- Tactics, techniques, and procedures from the MITRE ATT&CK for ICS framework
Architecture for OT Security Monitoring
A well-designed OT monitoring architecture includes:
Network Collection Points:
- Network TAPs at the IT/OT DMZ boundary
- TAPs or SPAN ports at zone boundaries within the OT network
- TAPs on critical conduits connecting safety systems
OT Network Monitoring Platform:
- Purpose-built OT monitoring solution (Claroty, Dragos, Nozomi Networks, or equivalent)
- Deployed passively with no inline components in the control network
- Protocol decoders for all industrial protocols in the environment
Integration Layer:
- Filtered, contextualized alerts forwarded to the enterprise SIEM
- OT asset data enriching SIEM event correlation
- Bi-directional integration with the incident response workflow
SOC Capability:
- Analysts trained in OT protocols and industrial operations
- OT-specific playbooks for alert triage and investigation
- Escalation procedures that include operations and engineering teams
Building the Business Case
For CISOs and security leaders building the case for dedicated OT monitoring:
Regulatory drivers: IEC 62443 (SR 6.1, SR 6.2), NIST CSF (DE.CM), NERC CIP (CIP-007), and Saudi Arabia's OTCC all require continuous monitoring of OT environments. An IT SIEM alone does not satisfy these requirements.
Risk reduction: OT environments contain the highest-consequence assets in most organizations. The cost of a production shutdown, environmental release, or safety incident dwarfs the investment in purpose-built monitoring.
Visibility: Most organizations discover 30-50% more OT assets than they knew existed when they deploy passive monitoring. This visibility alone justifies the investment by identifying unknown risks.
Insurance: Cyber insurance underwriters increasingly require evidence of OT-specific monitoring capability. Generic IT SIEM coverage is no longer sufficient for policy compliance.
Implementation Approach
Deploy OT monitoring in phases to manage complexity and demonstrate value:
- Phase 1 - Passive Discovery: Deploy sensors for asset discovery and network visibility. Establish the baseline asset inventory and communication map.
- Phase 2 - Behavioral Baselining: Allow the platform to learn normal communication patterns. Tune the baseline over multiple operating cycles.
- Phase 3 - Alert Activation: Enable detection rules progressively, starting with high-confidence indicators and expanding as false positive rates are managed.
- Phase 4 - SOC Integration: Connect filtered OT alerts to the enterprise SIEM and SOC workflow. Train analysts on OT alert triage.
- Phase 5 - Advanced Detection: Implement process-aware detection, control logic monitoring, and threat intelligence integration.
Conclusion
Extending your IT SIEM to OT is not OT security monitoring. It is checking a box while leaving your most critical assets effectively unmonitored. Purpose-built OT monitoring is not optional for organizations operating industrial control systems. It is the foundation of continuous threat detection in environments where the consequences of a missed alert are measured in safety incidents, environmental damage, and production losses.
Beacon Security designs and deploys OT security monitoring solutions and SOC capabilities for industrial environments. Contact us to assess your current monitoring coverage and build a roadmap to effective OT visibility.
