Glossary

The words, in plain words.

29 terms a plant manager meets in an OT security conversation, each with its own link.

Where a public standard defines a term we paraphrase it; otherwise this is how the term is used on a plant floor. Every article on this site links here rather than explaining the same thing twice.

Active scan: Sending probes to devices to see what answers, the standard IT way of discovering a network. On a plant it can crash a controller that was never built to be asked questions, which is why Range does not run one below Level 3 and never without written authorisation.See also · Passive assessment
Asset inventory: The list of what is on the plant network: make and model, firmware, where it sits in the Purdue model, which zone, what it talks to, who owns it and which vendor can reach it. A spreadsheet of IP addresses is not one.See also · Purdue model · Firmware
BACnet: The protocol building management systems use to talk to chillers, air handlers, meters and controllers. Designed for interoperability, not for keeping strangers out; being on the network is being in control.See also · BMS
Building management systemBMS: The control system for a building’s plant: chillers, air handling, pumps, lighting, access and fire control. It is operational technology, and on a hospital or a data hall it keeps the building usable in a Gulf summer.See also · BACnet · OT
Compensating control: A protection put around a system that cannot itself be fixed: segmentation, allow-listing at the boundary, brokered remote access, monitoring, a locked cabinet. The usual answer for equipment that cannot be patched.See also · Segmentation · Firmware
Distributed control systemDCS: A control system where the controllers, the operator stations and the engineering tools are one integrated product, typical of continuous processes such as refining, chemicals and metals. Functionally close to PLCs plus SCADA, bought as one system.See also · PLC · SCADA
DNP3: The telemetry protocol common in water and power for talking to remote sites. It carries commands as well as readings and, in the form most sites run it, no authentication; a secure authentication option exists and is usually not switched on.See also · RTU · Telemetry
Engineering workstation: The computer that holds the project files and the software used to program controllers and HMIs. It can change what every controller does, which makes it the most sensitive machine on the floor, and it is often also the one that reads email.See also · PLC
Firmware: The software inside a controller or a device, as distinct from the project loaded onto it. Updated rarely on a plant, because an update is a change to a running process and may need the vendor’s validation first.See also · Maintenance window · Compensating control
Flat network: A plant network with no zones: one broadcast domain where every device can reach every other. It happens through growth and convenience, and it turns one compromised laptop into a plant-wide problem.See also · Segmentation · Zones and conduits
Historian: The database that stores the plant’s process data over time, for trends, reports and compliance. Because the office needs its data, the historian is often the one connection between the plant network and the business network that was designed on purpose.See also · Industrial DMZ
Human-machine interfaceHMI: The operator’s screen on a machine or line, usually a panel PC running a vendor’s software on top of a general-purpose operating system. It shows the process and lets the operator act on it, and it is often the oldest Windows on the site.See also · PLC · Engineering workstation
Level 3.5Industrial DMZ: The deliberate crossing point between the office network (Levels 4 and 5) and the plant floor (Levels 0 to 3). It only works if it is the only crossing point; most segmentation projects fail there, on paths nobody knew about rather than on the firewall rules.See also · Purdue model · Segmentation
Maintenance window: The planned period when a plant or a line is stopped and work that cannot happen while it runs can be done: firmware, patching, rewiring, segmentation changes. OT security work is planned around these, not around a monthly cycle.See also · Firmware
Mirror portSPAN: A switch setting that copies traffic from other ports to one port, where a passive capture can listen. Configuring it is a change to a live switch, which is why passive is lower risk rather than no risk, and why it is scheduled and agreed first.See also · Passive assessment
Modbus: One of the oldest and most common industrial protocols, used to read and write registers in controllers and drives. It has no authentication of its own: anything that can reach the port can read and, usually, write.See also · Flat network
OPC UA: A newer industrial protocol for exchanging data between controllers, supervisory systems and the office, with security built into the specification. Whether that security is switched on is a configuration question.See also · Historian
Operational technologyOT: The computers that control physical equipment: controllers, operator screens, supervisory systems and the networks between them. OT security is about keeping those systems doing what the plant expects, which is a different job from protecting office data.See also · PLC · SCADA · Purdue model
Passive assessment: Finding out what is on a plant network by listening to its traffic rather than sending anything into it. It sees what talks, to what and over which protocol, without the risk an active scan carries for old controllers. It is how every Range engagement starts.See also · Active scan · SPAN
Programmable logic controllerPLC: The small industrial computer that runs a machine or a process: it reads sensors, decides and drives outputs, many times a second. Built to run for decades, which is why the one on your line may be older than the people operating it.See also · HMI · Firmware
Purdue model: The reference model for where an asset sits in a plant, from the sensors and actuators at Level 0 up to the business network at Level 4 and 5. It is the diagram everyone in this field draws, and the levels are the vocabulary for talking about which systems should be able to reach which.See also · Industrial DMZ · Zones and conduits
Remote terminal unitRTU: A small controller at a remote site such as a pump station or a reservoir, built to run unattended and report back over a telemetry link. It carries commands as well as readings, so the link that reaches it matters.See also · Telemetry · DNP3
Safety instrumented systemSIS: The independent system that takes a process to a safe state when something goes wrong: shutdowns, trips, interlocks. It is designed and tested to its own standards and kept separate from normal control, and it is the last thing anyone should touch on a network.See also · PLC
Security levelSL: ISA/IEC 62443’s scale from 1 to 4 for how capable an attacker a zone is meant to resist, from casual misuse up to a well-resourced adversary. A target level is chosen per zone; what the equipment can reach and what is actually achieved are assessed separately.See also · Zones and conduits
Segmentation: Dividing a plant network into zones with controlled paths between them, so that reaching one part does not mean reaching all of it. On a running plant it is a staged project around maintenance windows, not a weekend change.See also · Zones and conduits · Industrial DMZ
Supervisory control and data acquisitionSCADA: The supervisory layer that collects data from controllers across a site or a district and lets operators monitor and command them from one place. Common in water, power and anything spread over distance.See also · RTU · Telemetry
Telemetry: Readings and commands carried between remote equipment and a supervisory system over radio, cellular or leased lines. The path that carries a reading out can usually carry a setpoint in.See also · RTU · SCADA
Vendor remote access: The connection a machine builder, integrator or service contractor keeps into a plant to support its equipment: a modem, a VPN appliance or a cloud agent. Usually fitted at commissioning, usually outliving the project, rarely on a drawing. Good control is brokered, time-boxed and logged.See also · Asset inventory
Zones and conduits: The way ISA/IEC 62443 describes a segmented plant: a zone is a group of assets with the same security needs, and a conduit is a controlled path between zones. The exercise of drawing them is where most of the value of the standard sits.See also · Segmentation · SL

A term you did not find? Ask us what it means on your floor.

Book a passive assessment The writing