OWASP TOP 10 with a new focus - An overview of the key OT security risks

Operational Technology (OT) environments are regularly confronted with special security requirements that differ fundamentally from those of traditional IT. Longer lifecycles (1-3 decades), a focus on availability rather than confidentiality and special supplier relationships create a unique threat landscape with individual attack surfaces. Attacks such as Stuxnet, TRITON and Industroyer2 have demonstrated the real impact of OT vulnerabilities in the past. This presentation will focus on the OWASP OT Top 10 - a collaborative project that identifies the most critical security risks in OT environments. We cover the OT-specific kill chain, explain why IT security approaches are not directly applicable to OT, and go through the top 10 categories, including unknown assets, loss of availability, corrupted zones and lines, and insufficient access control. Each category complies with established standards such as IEC 62443, NIST SP 800-82 and the EU NIS2 directive.