OT vs IT Security
Operational technology and information technology face different threats, priorities, and constraints, so the same security playbook cannot serve both.
Two Worlds, Two Priority Orders
Information technology (IT) manages data: email, databases, web services, business records. Operational technology (OT) manages physical processes: pumps, valves, magnets, cryogenics, breakers. The classic security triad is confidentiality, integrity, availability (CIA). IT typically ranks them confidentiality first. OT inverts the order to availability and integrity first, because a controller that stops responding, or that acts on corrupted commands, can damage equipment or endanger people.
Why the Playbooks Diverge
An IT server can be patched on a Tuesday and rebooted. An OT controller may run a process that cannot be interrupted without a controlled shutdown, and its vendor may certify only specific firmware. IT devices refresh every few years; OT devices run for decades. IT tolerates a few hundred milliseconds of latency; a control loop may demand deterministic timing measured in milliseconds. Encryption that is trivial on a server can overrun the CPU budget of an embedded controller.
Consequences of a Breach
- IT breach: data theft, service outage, financial and reputational harm
- OT breach: physical damage, safety events, environmental release, loss of process control
Convergence and Its Risks
Modern plants connect OT to IT for monitoring, analytics, and remote support. This convergence delivers real value but erases the natural isolation OT once enjoyed. Every new link is a potential path for an attacker to cross from a compromised email account into a control network. The discipline is to connect deliberately: defined interfaces, one-way data flows where possible, and segmentation that assumes IT will eventually be compromised.
Fusion Context
A fusion facility such as the Hyperion breeder or a burner installation is dense with OT: superconducting-magnet power supplies, cryoplant, vacuum, fueling, and the machine-protection and safety systems. These are design and simulation targets today, not operating hardware, but the security architecture is specified early precisely because retrofitting isolation onto a live plant is far harder than designing it in. Treating OT and IT as one flat network is the mistake this distinction exists to prevent.