The discipline of protecting industrial control systems — programmable logic controllers, distributed control systems, and supervisory control platforms that directly command physical process equipment — from cyber threats, representing the most safety-critical subset of operational technology security.

Key Points

Focuses specifically on the controllers and control platforms that directly command physical equipment — PLCs, DCS, SCADA — rather than the broader OT security domain's wider scope of sensors, networks, and supporting infrastructure
A compromised ICS can directly issue commands to physical equipment, making ICS compromise the most severe category of OT security incident, with the potential to cause direct physical or safety consequences rather than just data or availability loss
ICS devices are frequently among the longest-lived equipment in an industrial environment, commonly remaining in service for decades with limited practical ability to apply conventional IT-style security patching
Legacy ICS protocols (Modbus, DNP3, and similar) were largely designed without authentication or encryption, since physical isolation was the assumed security model at the time of their design
ICS security incidents have driven the development of ICS-specific security standards and frameworks distinct from general IT security frameworks, reflecting how different the threat model and acceptable mitigation approaches are

Concept

An ICS occupies the most consequential position in an industrial environment's technology stack, since it is the layer that directly translates digital commands into physical action — opening a valve, starting a motor, adjusting a setpoint. ICS security specifically addresses this layer's protection, recognizing that a compromise here has a more direct and immediate path to physical consequence than a compromise of, say, a sensor reporting data or a network switch carrying traffic.

Explainer

The legacy protocol problem is particularly acute for ICS security because the controllers and control networks in question were frequently designed decades before cybersecurity was a serious consideration for industrial equipment, under the reasonable-at-the-time assumption that physical isolation made authentication and encryption unnecessary overhead — an assumption that has aged poorly as IT-OT connectivity has grown, leaving many operational ICS environments running protocols with no built-in security features on hardware with limited or no capacity for retrofit security controls. This is why ICS security practice leans heavily on network-layer compensating controls — segmentation, monitoring, strict access control at the network boundary — rather than attempting to secure the ICS devices and protocols themselves directly, since the devices and protocols in question were often never designed to support that kind of direct security hardening. For CE verticals, ICS security represents the highest-stakes layer of the broader OT security posture across mining, energy, and industrial operations — the specific controllers managing safety-critical processes deserve security attention proportional to the direct physical consequences their compromise could cause, distinct from and beyond the general OT security hygiene applied more broadly across an operation's connected footprint.

Cite this entry

ICS Security. ConnectedEarth Knowledge Base. https://connectedearth.space/knowledge-base/ics-security/ (updated 13 September 2026).