Are red team tests frequently conducted at production facilities?

In an exclusive interview with Wise TV, Murat Lostar, General Manager of Lostar, explains why Red Team exercises are limited in OT (Operational Technology) environments and how security testing should be conducted in this sector.

Red Team exercises are not—and cannot be—widely conducted in OT environments. The primary reason for this is that sufficient security measures have not yet been implemented. Furthermore, unlike in IT, performing a Red Team service or exercise in an OT environment carries the risk of data theft or system damage. A potential attack in OT—even a well-intentioned Red Team exercise—can instantly halt production or cause service interruptions, resulting in significant costs. Consequently, services such as smaller-scale, more controlled OT-focused penetration tests and vulnerability assessments take precedence. Organizations that have bolstered their security posture and completed the necessary investments are gradually beginning to move toward Red Team exercises in this area as well. I believe we will see this trend intensify in the near future.

Security and Red Team Approaches in OT Environments

Industrial control systems and operational technology (OT) environments lie at the heart of modern manufacturing and industrial processes. However, the security of these systems involves a structure that is distinct from—and more complex than—that of information technology (IT) systems. Security in OT environments goes beyond merely protecting against data loss or cyberattacks; it also ensures the uninterrupted continuation of physical processes. Consequently, Red Team exercises in OT environments are less common than in IT environments and require a more cautious approach.

Differences Between OT and IT Security

The fundamental difference between OT and IT security lies in the fact that OT interacts directly with physical processes. While a security breach in IT systems typically results in data loss or a compromise of confidentiality, such a breach in OT systems can lead to the halting of production processes or physical damage. Therefore, OT security demands a higher level of attention and care.

Risks of Red Team Exercises

Red Team exercises are an effective method for identifying system vulnerabilities. However, due to the sensitive nature of OT systems, such exercises can be risky in these environments. A single misstep could disrupt production processes or damage physical equipment. For this reason, Red Team exercises in OT environments must be conducted in a more controlled and careful manner.

Alternative Security Approaches

Given the risks associated with Red Team exercises in OT environments, smaller-scale and more controlled security tests are preferred. Penetration testing and vulnerability analysis serve as safer and more effective methods for identifying security weaknesses in OT systems. These tests enable the implementation of necessary measures to enhance system security. The Importance of Security Investments

As organizations increase their investments in OT security, the need for Red Team exercises also grows. Organizations that have already implemented security measures and invested in this area are now turning toward more comprehensive security testing. This represents a significant step in enhancing the security of OT environments.

Future Security Trends

Security measures within OT environments are expected to intensify in the near future. By increasing their security investments, organizations are developing more comprehensive and effective security strategies. This is critical for bolstering the security of OT systems and ensuring the continuity of production processes.

Conclusion

Security in OT environments involves a structure that is distinct from—and more complex than—that of IT systems. While Red Team exercises are an effective method for enhancing OT system security, they must be approached with caution. Smaller, controlled security tests offer a safer and more effective way to improve OT system security. By increasing their security investments, organizations are taking significant steps to ensure the security of their OT environments.