Power plants, water works and factories run on operational technology, and protecting it takes more than a regular firewall.
In OT security, which goal usually comes first?
Availability and safety of the process
Confidentiality of stored data
Anonymity of the plant operators
Speed of software updates
Right! In OT, a stopped or unsafe process can hurt people or equipment, so availability and safety lead, unlike IT's usual focus on confidentiality.
The answer is availability and safety. Industrial systems control physical processes, so keeping them running safely matters more than data secrecy.
Why are PLCs in a plant often left unpatched for years?
Their vendors forbid any software changes
Patching needs downtime and retesting the process
They cannot be infected by any malware
Patches for them only exist on paper
Exactly! Updating a controller can mean stopping production and requalifying the process, so plants patch rarely and plan it carefully.
The reason is downtime and retesting. PLCs can be infected, but a patch may stop the process and must be tested first, so it often waits.
Which malware, found in 2010, sabotaged Iranian uranium centrifuges?
WannaCry
NotPetya
Stuxnet
Mirai
Correct! Stuxnet altered Siemens PLC logic to damage centrifuges while showing operators normal readings.
It was Stuxnet. It reprogrammed Siemens PLCs to spin centrifuges out of spec while replaying normal values to operators.
Scratch the card to reveal a fact about industrial security
Many industrial controllers run for 20 to 30 years, far longer than a typical office laptop's three to five.
What is a key security weakness of the classic Modbus protocol?
It only works over satellite links
It has no built-in authentication
It encrypts data with a broken cipher
It needs a cloud server to run
Yes! Classic Modbus accepts commands from anyone who can reach the device, with no check of who sent them.
The weakness is no authentication. Modbus was designed in 1979 for trusted serial links, so any device that can reach it can send commands.
In the Purdue model, which level holds the physical sensors and actuators?
Level 3
Level 4
Level 0
Level 2
Right! Level 0 is the physical process: sensors, valves, motors. Controllers sit at level 1 and supervision at level 2.
It's Level 0, the physical process itself. Controllers are level 1, supervisory systems level 2, and business IT sits at levels 4 and 5.
Flip the card to reveal a fact about OT
In 2017 the Triton malware targeted safety instrumented systems, the last line of defence meant to stop industrial disasters.
Did you know?
A plant claims its OT network is air-gapped. Which still threatens it?
A USB stick plugged in by a contractor
Phishing emails sent to the OT switches
Ransomware in the public cloud only
Weak passwords on the cafeteria Wi-Fi
Spot on! Removable media crosses air gaps easily, which is how Stuxnet is believed to have spread.
The real threat is a USB stick. An air gap blocks network paths, but people carrying removable media can bring malware straight in.
Which standard series is built specifically for industrial automation security?
ISO/IEC 27001
IEC 62443
PCI DSS
ISO 9001
Correct! IEC 62443 covers security for industrial automation and control systems, including zones and conduits.
It's IEC 62443. ISO 27001 is general information security, PCI DSS is for card payments and ISO 9001 is about quality.
Why is aggressive active scanning risky on an OT network?
Old devices may crash from unexpected traffic
Scanners legally count as an attack there
OT devices hide behind invisible IP addresses
Scans permanently erase network switch logs
Yes! Fragile legacy controllers can freeze from malformed or heavy traffic, so OT teams prefer passive monitoring.
The risk is crashing old devices. Many legacy controllers can't handle unexpected packets, so passive monitoring is the safer choice.
Drag the slider to reveal a fact
Can a fish tank hack a casino?
Yes: attackers reportedly entered a casino network through an internet-connected aquarium thermometer, showing how small devices open big doors.
In 2015, attackers cut power to about 225,000 people in which country?
Estonia
Ukraine
Germany
Georgia
Right! The December 2015 Ukraine attack was the first confirmed cyberattack to cause a power outage.
It was Ukraine. In December 2015 attackers remotely opened breakers at substations, the first known grid blackout from a cyberattack.
What device allows data to flow only one way out of an OT network?
A load balancer
A VPN concentrator
A data diode
A proxy server
Exactly! A data diode physically allows traffic in one direction, so data can leave but no command can come back in.
The answer is a data diode. It enforces one-way flow in hardware, so monitoring data can go out while nothing can get back in.
How useful was this OT/IT security quiz?
Perfect! Every answer right!
10 of 10 right
100%
Challenge your colleagues to test their industrial security know-how!
Without one, it says “A friend”.
Please choose another nickname.
Question 1: In OT security, which goal usually comes first?
Question 2: Why are PLCs in a plant often left unpatched for years?
Question 3: Which malware, found in 2010, sabotaged Iranian uranium centrifuges?
Question 4: What is a key security weakness of the classic Modbus protocol?
Question 5: In the Purdue model, which level holds the physical sensors and actuators?
Question 6: A plant claims its OT network is air-gapped. Which still threatens it?
Question 7: Which standard series is built specifically for industrial automation security?
Question 8: Why is aggressive active scanning risky on an OT network?
Question 9: In 2015, attackers cut power to about 225,000 people in which country?
Question 10: What device allows data to flow only one way out of an OT network?
Made with AI. This quiz was made with AI, which can make mistakes.
