When most people think about cyber security, they think about IT: databases, personal information, credit card details. In mining, oil and gas, and other resources operations, there is a second environment that matters just as much: Operational Technology (OT) and Industrial Control Systems (ICS). These present a completely different set of risks.
Why a breach here is different
If IT gets breached, you can usually isolate the affected systems, restore from backup, and keep the business running some other way. It is painful and costly, but no one gets hurt.
In OT and ICS environments, a breach can be a safety issue, in the worst cases a life-threatening one, because these systems control physical equipment. An uncontrolled change to the wrong system can cause an explosion or damage that takes months to repair. And unlike a corporate outage, most industrial sites have no manual fallback. If the ICS cannot run, nothing gets produced or processed until it is fixed.
The numbers keep moving in the wrong direction
The Australian Signals Directorate’s most recent Annual Cyber Threat Report (2024 to 2025) recorded over 1,200 cyber incidents nationally, an 11 per cent increase, with critical infrastructure incidents up 111 per cent and now making up 13 per cent of all reported cases (cyber.gov.au).
Sector-specific research shows the exposure is not evenly spread. Oil and gas organisations recorded the highest rate of malware protection and detection gaps of any sector reviewed, appearing in 37 per cent of findings, and the worst vulnerability management gaps at 31 per cent of findings (Fortinet, 2026 State of Operational Technology and Cybersecurity Report). Ransomware groups targeting industrial organisations grew from around 80 to 119 in a single year, hitting an estimated 3,300 industrial organisations in 2025 (TXOne Networks).
Why OT and ICS need different solutions
The IT-centric view treats every connected system the same way. Two examples show why that does not hold up on site.
Keeping systems patched is standard IT advice, but what happens when the software controlling a series of pumps only runs on an old, unsupported version of Windows? You can end up with millions of dollars of equipment reliant on a PC that cannot be safely updated without breaking the system it runs.
Password rotation is another standard control that breaks down in a control room. Operators across multiple shifts often share logins because stopping to remember a password during an active incident is not realistic. These systems are usually built on the assumption that once you are in, you are authorised for everything.
The classic confidentiality, integrity, availability model that drives most IT security also prioritises the wrong thing for OT. In a plant, availability comes first. Keeping the equipment running matters more than protecting sensor data that was never confidential in the first place.
Stop doing, keep doing, start doing
Stop doing:
- Treating IT and OT security as the same problem. They need different thinking, and OT/ICS stakeholders should have a seat at the cyber security table, not be managed from a distance.
- Underestimating the cost of an OT breach relative to a corporate one. Physical security alone is not enough, and production downside can dwarf a typical corporate incident.
Keep doing:
- Separating systems, physically and digitally. Most sites have some separation already; the gap is usually that it is physical only. Surveillance systems should not sit on the same network as ICS, and no ICS system should be reachable from the corporate network.
- Keeping OT and ICS computers off the internet and away from shared applications like email. It sounds obvious, but a control room PC doubling as an email terminal is still common.
- Maintaining separate identity systems between corporate and OT/ICS networks, so a compromised credential on one side does not open the other. The Colonial Pipeline incident in the United States remains the clearest public example of what happens when that separation is unclear.
Start doing:
- Naming clear ownership for OT and ICS cyber security in your governance documentation, so it does not fall into the gap between IT and operations.
- Extending cyber security awareness training to operational staff, not just corporate teams. Operational staff can click a bad link too.
- Application whitelisting on OT and ICS equipment, so only essential control applications can run.
- Extending penetration testing programs to cover OT and ICS networks, not just corporate IT.
- Keeping proactive asset management and network documentation current, so no one is protecting equipment they cannot fully account for.
Where this leaves you
This is the tip of the iceberg on OT and ICS cyber security. As industrial equipment keeps getting more connected, the exposure keeps growing, and most organisations understate their actual risk. Our OT cyber security team can run a proper risk assessment of your environment so you know exactly where you stand and what to prioritise. Contact us to discuss your site.