Production equipment, industrial control systems, and enterprise networks are now closely connected. This enables more efficient workflows, predictive maintenance, and better sharing of operational data. At the same time, these connections create pathways through which cyberattacks can affect production. This makes it all the more important to detect security incidents early, assess them in context, and weigh potential responses against their impact on ongoing operations.
An OT SOC extends security monitoring to address the requirements of industrial environments. Its greatest value comes from assessing OT and IT together. OT telemetry provides an important foundation: It makes communications, technical changes, and security-relevant activities within the production environment visible.
Four recommendations for mid-sized businesses
An OT SOC combines threat detection with an understanding of production
A security operations center (SOC) monitors security-relevant events, assesses anomalies, and coordinates the response to potential attacks. An OT SOC also accounts for the specific characteristics of operational technology (OT): systems that monitor and control physical processes. These include industrial controllers, supervisory control systems, human-machine interfaces (HMIs), and engineering workstations.
Reliable detection and assessment of anomalies are particularly important in OT because response measures can directly affect plant operations. Disconnecting a suspicious system from the network may contain an attack. However, when the system is critical to production, the same measure may disrupt production processes or stop them entirely.
Both the security incident and the operational impact of potential measures therefore need to be considered. Availability, functional safety, and time-critical processes are central to this assessment. Automated interventions, in particular, require special caution. Measures affecting production-critical systems therefore require close coordination between the security team and those responsible for plant operations.
Further reading: NIST Guide to Operational Technology (OT) Security
OT telemetry provides visibility into production
To make informed assessments, the SOC needs information from the industrial environment itself. OT telemetry provides important insights.
In practice, however, access to this data is often limited: On many production-critical systems, installing endpoint detection and response (EDR) agents, as used to monitor endpoints in conventional IT environments, is either not permitted or not technically feasible. Production networks have also evolved over many years, with equipment from different vendors and generations using a variety of communication protocols, some proprietary or legacy. Information therefore often needs to be collected passively from the network or through existing logs and interfaces.
Depending on the systems in use and the available data collection capabilities, this may include:
- Communication relationships between plant components
- New devices or previously unknown connections
- Access to controllers and engineering systems
- Changes to configurations or control programs
- Device events and selected status information
This data helps establish an understanding of normal operations and investigate deviations. Is an engineering workstation communicating with a particular controller for the first time? Is access occurring outside a scheduled maintenance window? Is a configuration being changed without a corresponding work order?
Network-based data collection, in particular, can reveal communication patterns and anomalies without directly interacting with production-critical systems. However, suitable mirror ports, sensors, or centralized log data are not available in every network segment. Data collection and integration therefore need to be planned individually for each environment, ideally without adding load or interfering with ongoing operations.
The value of OT telemetry lies in making observable activities visible and assessable for security analysis. It complements visibility into user accounts, endpoints, and maintenance access with information about what is happening inside the production environment.
The insights it provides depend on the coverage and depth of data collection. Network data alone, for example, does not reveal every local change to a controller. Data sources should therefore be selected deliberately, their integration coordinated with those responsible for operations, and any remaining visibility gaps taken into account.
Four common challenges for an OT SOC
Not every OT component can be monitored like a conventional IT endpoint. EDR agents often cannot be deployed on production-critical systems. Legacy protocols and network segments without suitable sensors create data gaps that need to be considered during assessment.
A technical alert alone says little about its significance for production. Without an up-to-date asset inventory and knowledge of system functions, dependencies, maintenance activities, and equipment status, the SOC has limited ability to prioritize and assess events.
Security teams focus on attack paths and security events, while those responsible for plant operations focus on availability and process stability. If assessment, decision-making, and escalation procedures have not been jointly defined, critical information and clear responsibilities will be missing during an incident. An effective OT SOC must bring both perspectives and their processes together.
Measures such as isolation or automated interventions can affect the production process. Responses must therefore be aligned with the operational context to avoid compromising production, availability, and functional safety.
IT and OT together provide a more meaningful picture
IT security brings experience in analyzing attack patterns, user accounts, endpoints, and network events for indications of a potential attack. OT teams understand the equipment, its dependencies, and the conditions required for safe and stable operations. OT telemetry connects these perspectives with concrete observations from production.
Together, they help answer questions relevant to incident assessment:
- Is the maintenance access authorized and intended for the current maintenance activity?
- Which plant components were accessed during this session?
- Is the observed communication part of normal operations?
- Was a detected change to a controller planned?
- What would be the consequences of restricting an affected system?
This combination provides a sound basis for prioritization and response.
The value comes from correlating events
An illustrative attack scenario shows why integrated monitoring matters: An attacker uses a compromised maintenance access path to reach an engineering workstation through an intermediary server. IT monitoring may detect an unusual login. OT telemetry then reveals a new connection to a controller and, if the relevant data is available, a change to its program.
Only by correlating these events does the potential attack path become clear:
- Suspicious access occurs through a maintenance access path.
- The access leads to a system connected to the production environment.
- An industrial controller is accessed from that system.
- The observed activity does not match any approved maintenance work order.
OT telemetry therefore supports both incident detection and investigation. It helps identify affected systems, reconstruct the sequence of events, and cross-check technical indicators against operational information.
It also makes legitimate activities easier to assess. If an anomaly matches a documented maintenance work order, this context can prevent unnecessary escalations.
Telemetry needs plant-specific knowledge
Meaningful monitoring starts with knowing which systems are present and what they do. An asset inventory helps identify devices and understand their importance to operations. Asset management is therefore one of the foundations of effective OT security monitoring.
CISA’s OT asset inventory guidance
For the SOC, however, a list of IP addresses is not enough. An observed connection becomes more meaningful when the functions of the devices involved and the production processes that depend on them are known. Technical detection and operational knowledge therefore need to come together: Only the plant context reveals the significance of an observed activity for operations.
This allows unusual access to a central controller to be prioritized according to its potential operational impact. A new connection during a plant retrofit, in turn, can be assessed in the context of the planned work.
Data collection must fit plant operations
Telemetry collection must also account for OT requirements. Passive network monitoring can capture communication data without actively querying the monitored devices. Existing logs and suitable system interfaces can provide additional information.
The methods that are suitable depend on the individual plant. Data collection, integration, and any additional load must be coordinated with those responsible. OT has specific availability, reliability, and safety requirements that must be considered when implementing security measures.
Further reading: NIST Guide to Operational Technology (OT) Security
When establishing an OT SOC, data sources should therefore be selected according to their value for specific detection and investigation tasks. Sufficient coverage, reliable timestamps, and accurate association of events with the relevant plant components are essential.
Shared processes turn monitoring into action
Even meaningful telemetry is of little use if responsibilities remain unclear during an incident. An integrated SOC therefore needs not only coordinated procedures but also a shared understanding of risks and operational impacts across the security team, IT operations, production, and maintenance.
The following questions should be resolved in advance:
- Who assesses an alert from the production environment?
- Who provides additional information on maintenance and equipment status?
- Who decides on interventions affecting plant operations?
- Which measures have already been approved?
- When must those responsible for plant operations or equipment manufacturers be involved?
Regular joint exercises help validate these procedures. They also reveal whether the available telemetry is sufficient to investigate an incident or whether information is missing at relevant points.
Integrated monitoring brings data and expertise together
Monitoring IT and OT together means connecting their information and processes in a meaningful way. The two domains have different requirements: An industrial controller needs different detection and response methods than an office workstation.
For businesses, the real benefit is not simply having more security data. It is being able to use that data to identify the potential operational impact of an incident more quickly.
An integrated SOC approach combines security-relevant information from IT and OT. Information on identities, endpoints, and access is supplemented with observations from production. Together with the knowledge of those responsible for plant operations, this enables a more informed assessment of what is happening, which processes could be affected, and what response is appropriate.
Four recommendations for mid-sized businesses
1.
Establish shared responsibility across IT and OT
2.
Enable targeted access to OT telemetry
3.
Link events to operational information
4.
Test detection and response together
An OT SOC must not only detect, but also assess events in context
An OT SOC delivers its greatest value not by collecting as much data as possible, but by connecting security-relevant events with the operational context of production.
This turns a technical alert into a sound basis for decisions: Which equipment is affected? What impact is possible? Is an immediate response required? And which measure can be implemented without unnecessarily interfering with production operations?
This is the strength of an integrated SOC approach: bringing together IT security expertise, OT telemetry, and plant-specific knowledge so that businesses can respond more quickly and appropriately when an incident occurs.
More articles on OT Security:
OT SECURITY
>> When cyber incidents impact production: What OT security has to do with business continuity <<
OT VISIBILITY
>> Blind spots in production networks: What needs to be visible for effective OT security <<