The Complete Guide to Industrial Cybersecurity for IIoT Networks

By Dustin Guttadauro, Product Line Manager - Telecom & Fiber, Infinite Electronics

Key Takeaway 

•   Industrial cybersecurity for IIoT networks requires securing both the digital and physical layers — most breaches that reach OT systems exploit weaknesses at the network edge, where physical cables, connectors, and surge protection are the first and last line of defense. 

•   IT/OT convergence has made IIoT networks a high-value target: OT devices like PLCs and SCADA systems often run for 20+ years on protocols (Modbus, DNP3, Ethernet/IP) that were designed for reliability, not security. 

•  NIST CSF 2.0 and IEC 62443 are the two frameworks most widely used for industrial network security; IEC 62443 is the most OT-specific of the two and maps directly to physical security zones and conduits. 

•   Network segmentation, shielded cabling, Ethernet surge protection, and fiber optic isolation are the physical controls that underpin every other layer of OT security — software alone cannot protect a network with unprotected physical access points.  

What makes IIoT networks a cybersecurity problem? 

Industrial IoT networks are harder to secure than corporate IT networks for one fundamental reason: the devices were never designed to be connected to the internet. A PLC running a cooling system in a chemical plant might be 15 years old. It communicates over Modbus — a serial protocol from 1979 that has no authentication, no encryption, and no concept of access control. That PLC is now connected, through layers of networking, to a corporate environment that itself connects to the cloud. Every connection point is exposed. The numbers reflect this. The 2023 ICS-CERT report documented 457 confirmed vulnerabilities in ICS components, a 25% increase from the prior year. More telling: over 60% of those vulnerabilities require no credentials to exploit. The devices weren't broken into — they were just connected to things they shouldn't have been, and attackers walked in. 

How does IT/OT convergence create security gaps? 

Operational Technology (OT) runs physical processes — motors, valves, conveyor belts, assembly arms. Information Technology (IT) runs data and business logic. For most of industrial history, these two worlds didn't touch. 

That changed when manufacturers started connecting production floors to ERPs, then to the internet, then to cloud analytics platforms. The efficiency gains were real. So were the consequences. 

OT engineers think about uptime. A patch that might require a 10-minute reboot is a serious operational risk when that device controls a continuous manufacturing process. IT engineers think about security. They want devices patched within weeks of a known vulnerability. These priorities clash constantly, and the compromise usually favors availability over security, which means known vulnerabilities stay unpatched in OT environments for months or years. 

The Purdue Model, which has guided industrial network architecture since the 1990s, defined five hierarchical levels — from physical field devices up to enterprise systems — and assumed clean air gaps between them. Those gaps are gone. The model is still useful as a conceptual framework, but the actual networks most manufacturers run today look like it. 

The practical result: attackers who compromise a corporate endpoint can pivot into OT networks that were designed assuming they'd never be reached from the internet. The Triton/TRISIS attack on a Saudi petrochemical facility in 2017 followed this exact path — IT compromise led to OT compromise, which led to an attempt to disable safety instrumented systems. 

What are the main attack vectors in IIoT networks? 

Four attack vectors account for most IIoT security incidents. 

Network intrusion through IT/OT boundary 

Attackers compromise a corporate network, then move laterally into OT segments. This works when IT and OT share flat network segments, when firewall rules are too permissive, or when a DMZ exists on paper but isn't enforced. The Colonial Pipeline attack in 2021 shut down 5,500 miles (about 8851.39 km) of fuel pipeline after ransomware spread from an IT environment — a direct consequence of inadequate segmentation. 

Firmware exploits on legacy devices 

OT devices rarely receive security updates. When a vulnerability is discovered in a PLC or HMI firmware — and they are discovered regularly — manufacturers may release a patch, but operators often can't apply it without a planned maintenance window that might be months away. Attackers exploit this lag. Some legacy devices have vulnerabilities that have been publicly known for years and remain unpatched in production environments. 

Physical layer vulnerabilities 

This one gets less attention than it deserves. An unshielded cable running through an electrically noisy industrial environment can be susceptible to induced signals. A network port with no surge protection is a direct injection point — a voltage spike caused by lightning, a motor start-up, or even a deliberate electrical event can damage connected equipment or create conditions an attacker can exploit. 

Physical tampering is also real. USB ports on HMIs, open Ethernet jacks on factory floors, and unlocked network closets are attack surfaces that software controls don't address. Stuxnet — still the most sophisticated ICS attack documented — required physical access to introduce the initial infection vector. 

Vendor and remote access compromise 

Most OT environments allow remote access by equipment vendors for maintenance. These connections are often poorly managed — shared credentials, no MFA, and connections that stay open when they shouldn't. The 2021 Oldsmar water treatment attack in Florida used a remote desktop connection to access a SCADA system and attempt to increase sodium hydroxide levels to dangerous concentrations. 

What does a layered IIoT security architecture look like? 

A practical layered security model for IIoT networks has five zones, each with specific controls: 

The physical layer (Zone 0) is where most guides stop paying attention. It's where L-com focuses. An unprotected Ethernet port connecting a field device to a control network is a gap where no amount of firewall configuration can close — if a surge event or physical intrusion can reach that cable, you have a problem. 

Ethernet surge protectors Installed inline between field devices and network switches absorb transient voltage events that would otherwise damage connected equipment or disrupt communications.Shielded industrial Ethernet cablesreduce susceptibility to electromagnetic interference from motors, VFDs, and welding equipment — sources of noise that are common on production floors and that standard Cat5e cables handle poorly. 

How is ICS/SCADA security different from IT security? 

The table below covers the key differences. Understanding them matters because applying standard IT security thinking to OT environments is one of the most common mistakes organizations make when they start a convergence project. 

The physical layer column is worth dwelling on. In a data center, a surge event is rare, and EMI is controlled. On a factory floor, both are routine. A motor starting up induces voltage spikes on nearby cables. Welding equipment creates ground faults. Lightning strikes hit outdoor infrastructure. OT security must account for electrical realities that IT security seldom thinks about. 

Which cybersecurity frameworks apply to industrial networks? 

Two frameworks dominate industrial cybersecurity practice. 

NIST Cybersecurity Framework (CSF) 2.0 

The NIST CSF organizes security controls into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. It's broad enough to apply to any organization and is widely used as a baseline for industrial security programmers in the US. The 2.0 version, released in February 2024, added governance as an explicit function — acknowledging that executive accountability and supply chain risk management are as important as technical controls. 

NIST CSF is a good starting framework, but it doesn't go deep on OT-specific requirements. You'll need to supplement it. 

IEC 62443 

IEC 62443 is the international standard developed specifically for Industrial Automation and Control Systems (IACS) security. It defines security levels (SL 1–4) for zones and conduits, maps to the Purdue model, and specifies requirements for both asset owners and equipment suppliers. If you're in a regulated industry — oil and gas, utilities, pharmaceuticals, or critical infrastructure — IEC 62443 is often the baseline your auditors will check against. 

The standard's zone-and-conduit model maps well to the layered architecture described above. Each zone has a defined security level; conduits (the connections between zones) have their own security requirements. Physical controls, including cable shielding and port protection, fall under the conduit requirements. 

CISA ICS Security Advisories 

The Cybersecurity and Infrastructure Security Agency publishes regular advisories on vulnerabilities in specific ICS products. If you run Siemens, Rockwell Automation, Schneider Electric, or Honeywell equipment – and most industrial operations run at least one of these – subscribing to CISA ICS advisories is basic due diligence. They tell you what's vulnerable before attackers exploit it. 

What are the 10 critical controls for IIoT security? 

These are the controls that security auditors consistently find missing in IIoT environments — and the ones that matter most for reducing actual risk. 

OT Cybersecurity Best Practices Checklist 

1. Implement Network Segmentation: Isolate OT/ICS networks from the corporate IT network using firewalls, industrial DMZs, and secure network zones. Avoid flat network architectures to limit lateral movement.   

1. Protect the Physical Layer: Install Ethernet surge protector’s fat every field device entry point and use shielded Ethernet cables in high-EMI environments to reduce electrical interference and equipment damage.  

1. Maintain a Comprehensive Asset Inventory: Keep a real-time inventory of every connected OT asset, including PLCs, sensors, HMIs, RTUs, switches, gateways, and industrial controllers.  

1. Enforce Least-Privilege Access: Grant users, applications, and service accounts only for the permissions required for their roles. Disable unused ports, protocols, and network services to reduce the attack surface.  

1. Follow an OT-Aware Patch Management Process: Apply vendor-approved firmware and software updates according to documented maintenance schedules. Always validate patches in a staging environment before deploying them to production systems.  

1. Secure Remote Access: Require VPN connections with multi-factor authentication (MFA) for all remote users. Log and monitor every remote access session to support auditing and incident response.  

1. Deploy OT-Specific Anomaly Detection: Use industrial intrusion detection systems (IDS) such as Dragos, Claroty, or Nozomi Networks to monitor protocol-level traffic and identify abnormal behavior in OT environments.  

1. Develop and Test an Incident Response Plan: Create an ICS-specific incident response plan that addresses operational continuity, safety system isolation, and recovery procedures. Regularly test the plan through tabletop exercises or simulations.  

1. Assess Vendors and the Supply Chain: Evaluate third-party vendors, verify firmware provenance, and require digitally signed software and firmware updates to reduce supply chain risks.  

1. Use Fiber Optic Isolation at Network Boundaries: Deploy fiber optic media converters and fiber links at IT/OT network boundaries to provide galvanic isolation, eliminating ground loops and preventing surge propagation between networks. 

A note on controls 2 and 10: these are the physical infrastructure decisions that most cybersecurity frameworks mention but don't specify. The cable you run to a remote temperature sensor on an outdoor pipeline needs to handle the electrical environment it's in — shielded, properly grounded, with surge protection at the network entry point. This is infrastructure work, not IT work, and it often falls into a gap between the network team and the facilities team. 

Fiber optic isolation deserves specific mention. At the boundary between OT and IT networks — or at Zone 0 entry points where outdoor cables meet indoor equipment — fiber eliminates the galvanic path that allows surge energy and ground loop currents to travel. There's no copper to conduct the transient. It's a clean isolation that no surge arrestor can fully replicate. 

Why does physical layer security matter for IIoT networks? 

Physical layer security gets less attention than network segmentation or endpoint protection, but it's where industrial networks are most exposed. 

Here's the sequence that causes problems. A sensor on a factory floor sends data over a Cat6 cable to a network switch 200 feet away. That cable runs through a cable tray near a 480V motor drive. Every time that drive starts up, it induces a transient voltage spike on the cable. Over time, those spikes degrade the connected switch port. Eventually, the port fails, causing a network disruption that might look like a cyber-event but is actually electrical damage. 

More directly: An Ethernet port on a field device without surge protection is a direct electrical path into the network. Lightning that strikes nearby infrastructure can follow that path into the switch, then into the network. The equipment damage is bad. The resulting network outage in a process control environment can be worse. 

From a security standpoint, unprotected physical ports are also access points. An open Ethernet jack on a factory floor, with no port security configured, is an easy network entry point for anyone with physical access. That includes contractors, maintenance crews, and anyone who can get near the equipment. 

The solution at the physical layer involves three product categories:Ethernet surge protectors for transient voltage protection at every field device connection;shielded industrial Ethernet cables (STP or FTP construction) for runs through electrically noisy environments; and fiber optic media converters and cables for long runs, outdoor installations, and zone boundary isolation. These aren't add-ons to a security architecture — they're the foundation it sits on. 

Building a Secure IIoT Network: Where to Start 

Most IIoT security programs start in the wrong place — with software tools and policies, before the physical network is properly designed. The right starting point is the cable and connector infrastructure that everything else depends on. 

L-com's industrial networking components are specified for the electrical and mechanical demands of OT environments—not repurposed commercial-grade hardware. If you're designing or hardening an IIoT network, the physical layer is the right place to start: 

Frequently Asked Questions 

Q1: What is IIoT security? 

A: IIoT (Industrial Internet of Things) security covers the practices, controls, and technologies used to protect connected industrial devices and networks from cyberattacks, electrical damage, and unauthorized access. It's distinct from general IoT security because IIoT environments include operational technology (PLCs, SCADA systems, sensors) that control physical processes — where a security failure can have safety, operational, and financial consequences beyond data loss. 

Q2: What is OT cybersecurity? 

A: OT (Operational Technology) cybersecurity is the practice of securing the hardware and software that monitor and controls physical equipment — manufacturing systems, energy infrastructure, water treatment, and transportation. OT security differs from IT security in that availability and safety take priority over confidentiality; OT devices often can't be patched or rebooted on the same schedule as IT systems; and the protocols used (Modbus, DNP3, EtherNet/IP) were designed for reliability, not security. 

Q3: What framework should I use for ICS security? 

A: For most industrial organizations, the answer is both NIST CSF 2.0 and IEC 62443. NIST CSF provides a broad governance and risk management structure that works well for executive reporting and cross-functional planning. IEC 62443 is more prescriptive and OT-specific — it defines security levels for zones and conduits and is the standard most OT security auditors will reference. Organizations in regulated industries (utilities, oil and gas, and pharmaceuticals) will typically need IEC 62443 compliance.  

Q4: How do I secure remote access to SCADA systems? 

A: Remote access to SCADA and ICS systems requires layered controls: encrypted VPN connections (no direct RDP or VNC exposure to the internet), multi-factor authentication for all remote users, session logging with alerts for anomalous activity, and time-limited access that requires explicit re-authentication. Vendor access should use dedicated, monitored jump servers rather than direct connections to OT devices. Credentials should be individual — never shared team passwords for remote access.