OT Round table. Real talk on how to protect your OT spaces

The panel opens by defining operational technology as the control systems that drive physical processes, such as valves, pumps, bridges, power generation and water treatment. The speakers argue that these environments cannot be defended the way corporate laptops are. Outages can threaten safety and service, so downtime is scheduled rarely, sometimes only once a year. Many controllers have no agent support, vendors each use their own firmware tools, and a missed maintenance window can push a fix back by years.

The discussion then turns to recent disruptions at water systems across several US states. The panelists say small municipalities often buy the lowest-bid system with security left out of the contract, and that many operators lack logs to reconstruct what happened. They also challenge common myths: that a site is air-gapped, that it is too small to be targeted, or that IT tools will simply carry over. A screen-lock policy from the IT side that blanked an operator display at a power plant serves as an example of how well-meant changes can cause trouble.

For practical steps, the speakers recommend starting with an asset inventory, then segmentation, controlled remote access, and monitoring for devices that begin talking to unexpected peers. They stress assigning clear ownership of network gear, building relationships with plant staff, and educating leadership so budgets follow the risk. Their closing message is that OT and IT teams should share a common language and work as one team.