Protecting Critical Infrastructure Requires a Different Kind of Cybersecurity Training

A suspicious connection appears in a corporate network. The security team investigates, isolates the affected system and starts remediation. In a conventional IT environment, that may be a reasonable first response.

Now imagine the affected system controls part of an electricity substation, a water treatment facility or an industrial production line. Isolating it without understanding the operational consequences could disrupt a process that needs to remain stable and safe.

This is one of the defining challenges of operational technology (OT) security. NIST's Guide to Operational Technology Security explains that OT systems interact with the physical environment and operate under specific performance, reliability and safety requirements. Security decisions must account for those requirements alongside confidentiality and integrity.

NIST

+1

For cybersecurity workforce development, that changes the training equation.

Knowing the Network Isn't Enough

OT environments include industrial control systems, supervisory control and data acquisition (SCADA), building automation and other systems that monitor or control physical processes. Their operating requirements can differ considerably from those of ordinary business IT.

NIST

A security practitioner working in this environment needs to understand more than suspicious IP addresses or malware indicators. They need to recognize how digital activity connects to physical equipment and how an intervention could affect operations.

Practical OT cybersecurity skills include:

• Industrial architecture: understanding control systems, network segmentation and the relationship between enterprise IT and operational networks.

• Asset and communication mapping: identifying critical devices, their functions and the connections that support them.

• Safety-aware incident response: evaluating containment options with engineers and operators before making changes that could affect physical processes.

• Vulnerability and change management: assessing risk while accounting for maintenance windows, legacy equipment and operational constraints.

• Cross-functional communication: translating technical findings into decisions that engineering, operations and management teams can act on.

These capabilities cannot be developed entirely through conventional IT labs. They require scenarios that reflect how industrial environments actually behave.

The Industry Is Putting More Attention on Preparedness

On 8 October, the European Union Agency for Cybersecurity (ENISA) joined other European energy organizations for its ninth Cybersecurity Energy Forum, themed around grid cyber resilience and preparedness. The agenda reflects a changing energy system, with distributed generation, smart technologies, supply-chain dependencies and geopolitical tensions complicating the protection of critical infrastructure.

ENISA

+1

NIST has also published a draft revision of its OT security guide, SP 800-82 Rev. 4, with public comments due by 30 November 2026. That gives organizations a timely opportunity to review how their OT security practices account for current risks and operational requirements.

CSRC

+1

The workforce implication is clear: organizations need professionals who can connect security controls with the realities of industrial operations.

Train for Decisions, Not Just Detection

A useful OT exercise should give participants a realistic industrial scenario, a network diagram, asset information and evidence of suspicious activity. Their task is to investigate the event, identify affected components and propose containment measures without assuming that shutting everything down is automatically the safest option.

Engineers and security professionals should work through the scenario together. The exercise should test whether they can explain the risk, agree on priorities and maintain operational safety while responding to the incident.

That practical approach fits the broader purpose of ITSEC Cyber & AI Academy: helping learners build cybersecurity capability through structured learning and hands-on practice. OT security also requires specialized environments and subject-matter guidance, making scenario-based exercises a useful complement to foundational cybersecurity training.

The goal is to prepare professionals to make defensible decisions when security and operational continuity intersect.

Explore cybersecurity and AI learning at ITSEC Cyber & AI Academy.

References

1. European Union Agency for Cybersecurity (ENISA). “9th E.DSO – EE-ISAC – ENCS – ENISA Cybersecurity Energy Forum”. 8 October 2026.

2. National Institute of Standards and Technology (NIST). “Guide to Operational Technology (OT) Security, SP 800-82 Rev. 3”. September 2023.

3. NIST. “Operational Technology Security Publications”. Includes the SP 800-82 Rev. 4 draft published 21 September 2026.

4. European Network for Cyber Security (ENCS). “Register for the 9th E.DSO–EE-ISAC–ENCS–ENISA Cybersecurity Energy Forum”. 14 July 2026.