r/OTSecurity

Hello! I’m part of a team of MBA students at the University of Michigan Ross School of Business conducting a European market research project on behalf of Industrial Defender.

We’re reaching out to speak with cybersecurity and infrastructure leaders across water, electricity, utilities, and other NIS2-affected industries to better understand the European cybersecurity landscape.

Was wondering if anybody would be willing to help us out. We have funding to pay for your time!

Our CEO wants full visibility of all OT devices across our plants, rather than relying on manual asset inventory and stocktaking( what we are doing now)

I understand that achieving complete visibility in an OT environment can be challenging, especially with legacy systems, proprietary protocols, and the risk of disrupting production.

For those working in OT cybersecurity or ICS, are there any software solutions you would recommend for automated OT asset discovery and inventory management.

Ideally, the solution should provide accurate asset identification, device details, communication mapping, and ongoing visibility without actively scanning or disrupting sensitive OT devices.

Would appreciate hearing about your real-world experience with any tools you've used. Thanks!

Always fun to meet a redditir for a beer and make a connection.

How software, connectivity, cybersecurity, AI, remote access, and digital modification are changing machinery safety

Regulation (EU) 2023/1230 does more than replace Directive 2006/42/EC with a directly applicable machinery regulation. It extends machinery safety into the digital mechanisms through which modern machines are configured, programmed, connected, updated, remotely maintained and intentionally manipulated. This article examines that transition from conventional machine safety toward cyber-physical safety, beginning with the Regulation's legal structure, Essential Health and Safety Requirements (EHSRs), conformity-assessment model and rules on digital safety components and substantial modification. It then analyses Annex III §1.1.9 on protection against corruption, §1.2.1 on safety and reliability of control systems, and §1.2.6 on communication-network failure to determine when a cybersecurity weakness becomes a machinery-safety issue. The key distinction is causal: not every vulnerability constitutes machinery non-conformity, but cybersecurity becomes part of the safety case when compromise of software, configuration, data, communications or control authority can invalidate a risk-reduction assumption and produce hazardous machine behaviour. The article therefore connects traditional functional-safety methods under ISO 13849 and IEC 62061 with adversarial threat modelling, IEC TS 63074, IEC 62443 and the emerging EN 50742 machinery-specific standard for protection against corruption. It develops an authority-centric architecture that distinguishes connectivity, observation, operation, configuration, engineering and safety authority; applies that model to remote maintenance, safety-parameter manipulation and cloud-to-control attack paths; and shows why authentication or network segmentation alone cannot preserve a safety case. The analysis also extends into procurement, FAT/SAT, commissioned software and configuration baselines, patching, firmware updates, remote service, change control and the Article 3(16) substantial-modification test. Finally, it places the Machinery Regulation alongside the Cyber Resilience Act, NIS2 and the AI Act to separate product safety, product cybersecurity, organisational cybersecurity and AI-specific obligations. The resulting engineering proposition is that modern machinery conformity increasingly depends not only on the reliability of safety functions, but also on preserving the integrity, provenance and bounded authority of the digital dependencies on which those functions rely.

My background has mostly been in basic computing environments this far - largely Windows AD based, with tasking ranging from staying on top of patches, performing and reacting to vulnerability scanners, to implementing NIST controls. Fundamental stuff, enhanced with studies towards other points of interest (CISSP especially) and people's experiences here.

After my last contract ended I got picked up by another company that is leveraging that experience to put NIST controls on a physical space, as well as doing vuln scans and suchlike for others. So far I haven't really had to do anything too far outside of my experience base, though the target environment is more physical and less digital (for now).

All of this is basically a prelude for what the company wants to do longer term, and my team lead has been discussing putting together in-house labs and build experience with OT and industrial control systems. Naturally there will be a lean towards our current customer base and we'll probably be reaching out to them for support, but it got me thinking about other people's experiences with working in these environments, or even just setting up labs to try it out. Naturally I have some level of expectations, but don't yet have a whole lot of direct exposure into this realm yet, beyond essentials like physical security.

What kind of cyber stuff goes on out there in the OT / Industrial control world? What's your workflows and deliverables like, and what kind of tools do you interact with? What has lab building been like?