The Convergence Seam Where IT Meets OT

Every serious infrastructure attack eventually crosses one line: the boundary between the information-technology estate and the operational-technology plant. That boundary is where campaigns are won or lost, and it is the most misunderstood terrain in the facility. This lesson dwells on the seam itself.

Start with why the seam exists at all. Historically, plant controls were air-gapped — physically disconnected from business networks and the internet. That isolation was a genuine security property, and it is largely gone. Business demands pulled the two worlds together. Operators want live plant telemetry in their enterprise dashboards for efficiency and reporting. Predictive-maintenance programs want controller data flowing to analytics platforms. Vendors want remote access for support. Sustainability and cost reporting want power and cooling metrics in corporate systems. Each of these is a legitimate reason to connect OT to IT, and collectively they have dissolved the air gap at nearly every modern facility. The convergence is not a mistake to be undone; it is a condition to be managed.

The danger is that convergence is usually done incrementally and invisibly. No one decides to build an unbroken path from the internet to a breaker. Instead, over years, individual links get added, each justified on its own: a data historian that reads from controllers and is itself reachable from the corporate network; a vendor VPN into the controls segment; a jump host engineers use that sits with a foot in both worlds; a firewall rule opened for a project and never closed. Any one link is defensible. Their sum can be a continuous route from an email attachment to a motor, and because no single person designed that route, no single person is watching it. The attacker, who maps the whole graph, sees the route the defenders never assembled in their own minds.

This is why the layered reference model matters as an operational tool and not just a diagram. The discipline it demands is that traffic between IT and OT passes through a controlled, inspected boundary — often architected as a demilitarized zone between the two, where data is brokered rather than passed straight through. In a well-built facility, a controller never talks directly to a corporate server and certainly never to the internet. Instead a data broker in the middle zone reads from the plant and publishes to IT, so that no inbound path reaches the controllers directly. The historian lives in the middle zone, not on the plant. Remote vendor access terminates in a controlled jump environment with strong authentication and full session recording, not in a direct tunnel to a chiller. The boundary is minimal, monitored, and one-directional wherever it can be.

When that discipline is absent, specific weak points recur, and they are worth naming because they are the ones attackers reliably find. Dual-homed machines — a workstation or server with one network card on IT and another on OT — are among the worst, because they are a ready-made bridge that bypasses whatever firewall was supposed to separate the zones. Flat networks inside the plant, where every controller can talk to every other and to the supervisor without segmentation, mean that a single compromised device grants the run of the whole plant. Shared credentials that work on both sides of the boundary let an attacker reuse an IT foothold directly against OT. And unmonitored east-west traffic within the OT network means that once an attacker is inside, their lateral movement and reconnaissance go unseen.

The defensive program at the seam has a clear shape. First, know the boundary: enumerate every single connection between IT and OT, because you cannot defend links you have not listed, and most operators discover more links than they expected when they finally look. Second, funnel and inspect: reduce those connections to as few controlled crossing points as possible, route them through a brokered middle zone, and inspect what passes. Third, authenticate hard at the crossing: phishing-resistant multifactor authentication on every path into OT, no shared accounts spanning the boundary, full recording of vendor sessions. Fourth, segment inside: break the flat plant network into zones so a single compromise does not equal total control, following the principle that devices should only reach the devices they must. Fifth, monitor the OT side natively: deploy passive monitoring that understands industrial protocols so that unexpected commands, new devices, or reconnaissance stand out against a known-good baseline.

The throughline of this whole course crystallizes at the seam. The adversary does not respect the org chart that puts IT security in one department and facilities in another. They walk a single path across a boundary that two separate teams each assume the other is watching. Closing the seam is therefore as much an organizational act as a technical one: the people who defend the compute and the people who run the plant must share one map, one inventory, and one picture of the attack surface. The next module gives them the common language to do exactly that.