OT Security Testing: Methodology For ICS and SCADA

Operational Technology (OT) environments keep critical infrastructure running. From manufacturing plants and power grids to oil and gas facilities, water treatment systems, and transportation networks, these environments depend on Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems to monitor and control physical processes.

As OT environments become more connected to enterprise networks, cloud platforms, remote-access systems, and third-party applications, their attack surface continues to expand. A vulnerability in an IT environment may result in data loss or service disruption. In OT, the consequences can extend to equipment damage, production shutdowns, safety incidents, and disruption of critical operations.

This makes OT Security Testing different from conventional IT security testing.

Traditional Pentesting techniques cannot simply be transferred into an industrial environment. Security teams must understand the operational process, system dependencies, safety requirements, communication protocols, and potential impact of every testing activity.

Why OT Security Testing Requires a Different Approach

In an enterprise IT environment, a penetration tester may safely perform activities such as vulnerability scanning, service enumeration, authentication testing, exploitation, and privilege escalation.

In an OT environment, the same activity could have unexpected consequences.

For example, aggressive scanning against an industrial controller may cause:

• Device instability
• Communication delays
• Unexpected process behaviour
• Controller restarts
• Loss of visibility
• HMI communication issues
• Production disruption

Some legacy OT devices were designed for reliability and deterministic operation rather than modern cybersecurity. They may have limited processing capabilities, outdated operating systems, proprietary protocols, or undocumented dependencies.

Therefore, OT Security Testing must balance security validation with operational continuity.

The OT Security Testing Methodology for ICS and SCADA

A sound OT security testing engagement follows the familiar cybersecurity cycle of plan, discover, assess, exploit, and report, with safety controls added at every step. Each phase reduces uncertainty before the next, more intrusive one begins.

Phase 1: Scoping and Threat Modeling

The engagement begins with security leaders, plant engineers, and safety teams defining the scope. They identify systems that should not be tested, such as safety-instrumented systems, set testing windows, and agree on when testing must stop. The team then creates a threat model based on the types of attackers and techniques relevant to the industry. MITRE ATT&CK for ICS can be used as a reference to map techniques such as initial access, lateral movement, and process manipulation. This helps testers identify and validate the attack paths that could put the OT environment at risk.

Phase 2: Passive Discovery and Asset Visibility

You cannot protect systems you cannot see. In OT environments, asset visibility is often a major security gap. Testers can monitor network traffic through SPAN ports or network taps to identify PLCs, firmware versions, engineering workstations, protocols, and communication paths without directly interacting with controllers. This process can also uncover unknown devices, internet connections, or vendor modems that are missing from the official inventory.

Phase 3: Architecture and Configuration Review

The team checks whether the right security controls are in place. They verify that IT and OT networks are properly separated, firewalls allow only necessary connections, and remote vendor access is secure and monitored. They also review firewalls, switches, HMIs, historian systems, and Active Directory for common weaknesses, such as default passwords, poor network separation, unused services, and missing security logs. These are the gaps attackers often look for first.

Phase 4: Controlled Vulnerability Assessment

Vulnerability assessment in OT environments must be carried out carefully. Testers use low-impact checks on suitable systems and compare PLC firmware versions with known security advisories instead of testing controllers directly. Any active testing of PLCs should be done on spare equipment, a test bench, or a digital replica of the system. The usual steps of a vulnerability assessment still apply, but every test must be evaluated for its potential impact on operations.

Phase 5: Penetration Testing Along Real Attack Paths

Pentesting helps determine whether an attacker could access critical industrial systems. Testers simulate realistic attacks, such as using a compromised employee account or vendor connection, to see if they can move from the IT network to OT systems. In production environments, testing stops once access is confirmed. Risky actions, such as sending unauthorised Modbus commands, are demonstrated in a lab instead. This approach proves how an attacker could reach critical systems without putting live operations at risk.

Phase 6: Reporting, Detection, and Retesting

Findings are prioritised based on how easily they can be exploited and how much damage they could cause to operations, not just their CVSS scores. Since OT systems may take months to patch, each finding includes a long-term fix and temporary measures, such as better network separation, access restrictions, and stronger remote access controls. The testing results also help security teams set up alerts to detect similar attacks. A retest confirms whether the issues have been fixed. Priorities also depend on the industry, as risks in oil and gas operations differ from those in a building management system.

Standards That Connect OT Security Testing to Cybersecurity Governance

Testing results carry more weight when they map to the frameworks that govern the wider cybersecurity program. The ISA/IEC 62443 series defines zones, conduits, and security levels, giving testers a benchmark for segmentation and controls. NIST SP 800-82 Rev. 3, the Guide to Operational Technology Security, aligns OT protection with the NIST Cybersecurity Framework and cautions that active testing can disrupt control systems. Reporting findings against these standards lets CISOs track OT maturity alongside IT maturity in one risk register.

A full OT security assessment once a year is a common baseline, with extra testing after major changes such as new remote access, a network redesign, or connecting production lines to IT systems.

Integrating OT Into Your Cybersecurity Program

OT security testing closes the blind spot that many cybersecurity programs still carry. It observes before it touches, tests aggressively only where it is safe, and proves real attack paths so that limited maintenance windows go to the fixes that matter. Paired with core cybersecurity measures for industrial operations, it gives security and operations teams a shared, evidence-based view of risk.

Kratikal’s OT security services follow this phased approach, from passive discovery to a retest that confirms each attack path is closed, so your team acts on verified risk rather than scanner output. Because many OT attacks begin on the corporate side, network penetration testing checks whether an attacker could reach your control zones in the first place.

Conclusion

OT security testing requires more than finding vulnerabilities—it requires understanding how those vulnerabilities could affect real-world operations. In ICS and SCADA environments, every test must account for system availability, safety, process dependencies, and the potential impact on critical operations.

A phased approach that starts with passive discovery, followed by architecture review, controlled vulnerability assessment, carefully planned penetration testing, and retesting helps organizations identify genuine attack paths without unnecessarily disrupting production. Mapping these findings to frameworks such as ISA/IEC 62443, NIST SP 800-82, and MITRE ATT&CK for ICS further helps security and operations teams prioritize risk and strengthen their overall OT security posture.

FAQs