Cybersecurity for Industry, OT and Critical Infrastructure in Brazil

Why industry and OT became a priority target — and what is at stake

For decades, Brazilian industrial plants operated under the false sense of security of physical isolation. The network controlling turbines, conveyors, furnaces, valves and pumps was separate from the corporate network — the famous air-gap — and many automation engineers believed that, because they were not on the internet, these systems were immune to attacks. That premise collapsed. The pressure for operational efficiency, predictive maintenance, real-time telemetry and Industry 4.0 connected Operational Technology (OT) systems to the corporate IT network and, by extension, to the internet. The result is that industrial control systems (ICS) designed in the 1990s and 2000s, with no notion of authentication or encryption, are today a few network hops away from a phishing email opened by an administrative employee.

What distinguishes an OT incident from an IT incident is the physical consequence. When a cyberattack hits a corporate email server, the company loses productivity and data. When an attack hits the OT of a plant, it can stop an entire production line, shut down a water treatment station, open or close valves improperly, manipulate temperature and pressure setpoints, or disable safety instrumented systems (SIS) that exist precisely to prevent explosions and accidents. The loss is not measured only in reais per hour of downtime — though that number is brutal in continuous-process sectors — but in risk to the lives of operators, neighboring communities and the environment.

Attackers have understood this asymmetry. Ransomware groups realized that an industry with halted production pays the ransom faster than an office, because each hour of downtime is costly and the pressure from the board is immediate. Conceptually, the Colonial Pipeline case in the United States showed how a ransomware attack that hit only the IT network (billing systems) led, as a precaution, to the shutdown of the physical fuel distribution operation — proving that IT and OT are tied together even when they are believed to be separate. And the Stuxnet case, years earlier, demonstrated that sophisticated attackers can manipulate the physical behavior of centrifuges by reprogramming PLCs, hiding the manipulation from operators who watched everything appear normal on the supervisory screens.

In Brazil, manufacturing, power generation and distribution, oil & gas, sanitation and other critical infrastructure concentrate exactly the target profile adversaries seek: high dependence on operational continuity, a heterogeneous and legacy technology fleet, automation teams focused on availability (and not on cybersecurity) and external vendors with remote access. Understanding why your plant is a target is the first step. The second is to map, honestly, where the vulnerabilities are — and that is exactly what Decripte's free Threat Management plan does at decripte.com.br/intelligence-center, at no cost and no commitment.

The threat map against industrial and OT environments

Industrial ransomware is today the threat of greatest immediate impact. Unlike corporate ransomware, which encrypts documents and databases, ransomware that hits manufacturing environments frequently forces production to stop — whether because it encrypted the MES (Manufacturing Execution System) and the ERP that orchestrate the factory, or because the response team preventively shuts down the OT to contain propagation. Malware families have already demonstrated the ability to terminate industrial automation software processes before encrypting, precisely to cause the physical interruption. For the victim, the equation is cruel: pay the ransom or count the loss per hour of a halted plant, with cascading effects on contracts, fines and safety.

Beyond ransomware, there is the class of direct attacks on ICS, SCADA and PLCs. Here the adversary does not want money: it wants to manipulate the physical process or sabotage it. MITRE ATT&CK for ICS catalogs tactics specific to this world — from initial access via compromised engineering workstations, through executing commands on controllers, manipulating I/O points, denying view to the operator (spoofing the supervisory screens), to inhibiting response functions such as safety systems. These are techniques that require knowledge of industrial protocols like Modbus, DNP3, EtherNet/IP, PROFINET and OPC, many of them without native authentication, where any device on the network can send commands to a PLC.

The supply chain of embedded software is an increasingly exploited vector. Firmware of PLCs, HMIs and IIoT gateways, protocol libraries and even engineering tools can be compromised at the source, inserting backdoors that reach the plant already signed and trusted. Add to this insecure IIoT — industrial sensors, meters and cameras connected with default passwords, without updates and with exposed management ports — and vendor remote access, with VPNs and remote support tools frequently outside the control of the internal security team. Each machine vendor is a door; each forgotten open door is a path to OT.

IT/OT convergence amplifies everything. When the corporate network and the industrial network touch — through a data historian server, through an engineering workstation that also receives email, through a USB drive circulating between the two worlds — the phishing that compromised an administrative laptop now has a route to the shop floor. Mapping these paths, inventorying what exists and detecting anomalous traffic are technical tasks that Decripte performs with passive monitoring and 24x7 correlation. The free starting point is at decripte.com.br/intelligence-center: it already shows external exposure, known vulnerabilities and threats circulating against your organization.

IT/OT convergence and the Purdue model: architecting defense in depth

To protect an industrial environment you first need to understand its architecture, and the most widely used reference model for this is the Purdue model (Purdue Enterprise Reference Architecture), adopted as the backbone by ISA-95 and by IEC 62443 itself. It organizes the environment into hierarchical levels: Level 0 are the physical field devices — sensors and actuators that measure and act directly on the process; Level 1 are the controllers (PLCs, RTUs, IEDs) that execute the control logic; Level 2 is supervision (SCADA, HMI) where operators monitor and command; Level 3 is manufacturing operations management (MES, historians); and Levels 4 and 5 are corporate IT (ERP, email, internet). Above the border between OT and IT sits the industrial DMZ.

The strength of the Purdue model lies in making explicit that each level should communicate only with adjacent levels, through well-defined control points. In practice, this becomes the basis of network segmentation: industrial defense in depth creates zones (groupings of assets with similar security requirements) connected by conduits (controlled and monitored communication channels), a central concept of IEC 62443. The industrial DMZ, positioned between Level 3 and Level 4, is the lung that prevents the corporate network from talking directly to the control network — every piece of data that goes up (telemetry, historians) and every command or patch that comes down passes through replicated intermediate servers, never through a direct connection.

The problem is that IT/OT convergence, in real life, erodes those borders. Pressured by real-time dashboards, predictive maintenance and cloud integration, many plants created shortcuts: a historian that talks to the ERP and the cloud at the same time, an engineering workstation connected to the internet to download updates, a vendor link that jumps straight to Level 2. Each shortcut is a violation of the Purdue model that opens an attack path. The work of industrial cybersecurity is, in large part, to rebuild and enforce those borders without breaking the operation — because shutting down a legitimate conduit can stop the plant.

That is why the first technical deliverable of any serious OT project is the asset inventory and the communication flow map: discovering, ideally passively (without injecting packets that could disturb fragile PLCs), all the devices, their protocols and who talks to whom. Only with that map is it possible to design the zones, size the conduits, position industrial firewalls and define segmentation rules adherent to the Purdue model. Decripte conducts this survey with passive monitoring tools and correlates it with threat intelligence — and you can start seeing your exposure surface right now, for free, at decripte.com.br/intelligence-center.

Standards and regulation: IEC 62443, NIST SP 800-82, NIST CSF and LGPD in practice

IEC 62443 is the worldwide reference set of standards for cybersecurity of industrial automation and control systems (IACS). It is organized into four groups — general, policies and procedures, system and component — and introduces operational concepts such as zones and conduits, security levels (Security Levels, from SL 1 to SL 4, according to the sophistication of the attacker to be deterred) and the foundational requirements (access control, use, data integrity, confidentiality, restricted data flow, timely response to events and resource availability). Unlike generic frameworks, IEC 62443 speaks the language of the industrial world: it recognizes that availability and safety are priorities, that there are legacy assets that cannot simply be updated and that vendors, integrators and operators share distinct responsibilities.

Complementing it, NIST SP 800-82 — Guide to Operational Technology (OT) Security — is the reference technical guide for protecting ICS, SCADA, DCS and PLCs. It details the differences between IT and OT, proposes secure network architectures aligned with the Purdue model, addresses patch management in environments that cannot stop, monitoring, device hardening and OT-specific incident response. Together with the NIST Cybersecurity Framework (CSF) — which structures the program into the functions Govern, Identify, Protect, Detect, Respond and Recover — it forms the pair that most Brazilian organizations use to build and measure the maturity of their OT security program in an incremental and auditable way.

On the operational plane of detection and response, MITRE ATT&CK for ICS offers the taxonomy of tactics and techniques actually observed against industrial systems, allowing the security team to prioritize defenses and build concrete detection cases. And CISA (with its ICS advisories) and CERT.br in Brazil are continuous sources of alerts about vulnerabilities in specific industrial products — bulletins that report, for example, that a given PLC or HMI model has an exploitable flaw and what fix to apply. Following these sources and cross-referencing them with the plant's inventory is what turns OT vulnerability management into something actionable.

There is also the governance and data layer: ISO/IEC 27001 structures the information security management system that envelops the entire program, and LGPD comes in whenever the industrial operation processes personal data — of employees, of physical access control systems, of cameras and of biometrics on the shop floor. Regulated critical infrastructure sectors (energy, sanitation, oil & gas) also answer to specific sector requirements. Decripte offers compliance consulting and CISO-as-a-Service to map your plant against IEC 62443 and NIST 800-82, close gaps with a treatment plan prioritized by risk and sustain continuous improvement — without turning the standard into paper sitting in a drawer.

How Decripte implements OT security: from inventory to a 24x7 SOC

Decripte approaches industrial security in layers, starting with what you cannot protect without first knowing. The starting point is the discovery and inventory of OT assets, done preferably passively: by listening to the network traffic on a mirror (SPAN/TAP), we identify PLCs, HMIs, SCADA, IIoT gateways, engineering workstations and the industrial protocols in use, without injecting packets that could disturb sensitive controllers. From this inventory comes the communication map — who talks to whom, in which protocol and at what volume — which is the floor plan of the entire segmentation strategy aligned with the Purdue model and IEC 62443.

With the map in hand, we design and help implement IT/OT segmentation: definition of zones and conduits, design of the industrial DMZ, industrial firewall rules and microsegmentation where it makes sense, always validating that no legitimate production flow will be broken. In parallel, we conduct OT vulnerability management — cross-referencing the inventory with CISA advisories, CERT.br alerts and CVE databases — to prioritize fixes by real risk, considering that many devices cannot be updated immediately and require compensating controls (segmentation, detection rules, access restriction) until the maintenance window arrives.

Continuous defense is handled by Decripte's 24x7 SOC, with a team and AI monitoring the environment at all times. In the OT world, this means passive monitoring of SCADA/ICS traffic, detection of anomalous commands to PLCs, identification of new unauthorized devices, of scans and of lateral movement attempts between IT and OT — all correlated with MITRE ATT&CK for ICS and threat intelligence. Additional layers such as EDR/preventive security on engineering workstations and historians (where running an agent is possible) and edge/WAF protection on exposed industrial applications complete the defense belt, always respecting the golden rule of OT: nothing that compromises the availability of the process.

All of this can be designed to measure, but it starts simple and free. The free Threat Management plan at decripte.com.br/intelligence-center maps your organization's vulnerabilities and risks, monitors threats circulating against you and puts a team and AI 24x7 at your disposal for the first layer of visibility — from the MEI to the Enterprise. It is the fastest way to move from assumption to seeing, with data, where your plant is exposed before investing in controls.

Incident response in industrial environments: when every minute of downtime counts

Responding to a cyber incident in OT is not the same as responding in IT, and treating it as if it were can make everything worse. In IT, the containment reflex is to isolate and shut down the compromised machine. In OT, abruptly shutting down a controller can cause an overflow, an overpressure, a loss of process control — that is, the cybersecurity procedure can create a physical safety problem. That is why industrial incident response must be conducted by those who understand both cybersecurity and the process consequences, in direct coordination with automation engineering and plant operation.

Decripte's playbook for OT incidents follows a safety-first logic: rapid identification of what was compromised and what is still under control, containment that favors network segmentation and isolation over physical shutdown, evidence preservation (SCADA logs, historians, traffic captures) for forensic analysis, and process-stop decisions made together with operation, considering the physical impact of each action. The goal is to contain the adversary without turning a cyber incident into an operational safety incident, restoring the operation to a safe and reliable state as quickly as possible.

Speed matters because, in a continuous process, each minute of downtime has a direct cost and can compromise batches, equipment and deadlines. Decripte's Incident Response service is triggered with an engagement in under 1 hour, combining the response team with the 24x7 SOC that was already monitoring the environment — which drastically reduces the time between detection and the first effective action. When monitoring and response come from the same team, there is no rework of context: those responding already know the inventory, the topology and the plant's normal behavior.

As important as responding is learning. Each incident becomes input to strengthen the posture: new detection cases in the SOC, segmentation adjustments, edge rules, hardening recommendations and updates to the continuity plan. For organizations that do not yet have a response partner, the first step of preparation is to gain visibility — and the free plan at decripte.com.br/intelligence-center already delivers the threat mapping and initial surveillance that make any future response faster and more informed.

The human factor: operators, physical security and the border between digital and real

Behind every PLC and every supervisory screen there are people, and in industrial environments the human factor carries special weight because the plant operator is, at once, a line of defense and a target. It is the operator who notices when a valve behaves strangely, when a reading does not match physical reality, when something is wrong even though the screen says everything is fine. One of the goals of sophisticated attacks on ICS is precisely to blind the operator — to manipulate what they see in supervision so that physical sabotage happens without anyone noticing in time. Training operators to be suspicious, to report and to recognize signs of manipulation is a security control as real as a firewall.

The convergence between cybersecurity and physical security is another critical border. Access control systems, turnstiles, cameras, alarms and safety instrumented systems (SIS) are, today, connected assets — and a cyber compromise can open physical doors, disable video monitoring or inhibit protection functions that exist to prevent accidents. Likewise, unauthorized physical access to an engineering workstation or a network port on the shop floor is a direct path to OT that no firmware fixes. Protecting the plant requires treating the digital and the physical as a single risk perimeter.

Vendors and service providers are part of the human factor that most escapes control. Automation integrators, machine manufacturers and maintenance teams keep remote access, bring laptops and USB drives into the plant and, often, hold credentials with elevated privileges that no one reviews. Establishing a clear third-party access process — with strong authentication, monitored and recorded sessions, just-in-time access and revocation at the end of the service — closes one of industry's biggest gaps, and is as much a people-and-process problem as a technology one.

None of this is exclusive to large industry. From the small manufacturer with a few connected machines to the large energy utility, the logic is the same — only the scale changes. Decripte's positioning is to cover all sizes, from the MEI to the Enterprise, with the same technical seriousness. And the invitation is always the same: before deciding on any investment, gain real and free visibility of your exposure. The Threat Management plan at decripte.com.br/intelligence-center puts a team and AI 24x7 to map your risks, monitor threats against you and show, with data, where to start. It is free, and it is the first concrete step to bring your industrial operation out of the dark.

Termos do setor

OT (Operational Technology)

Hardware and software that monitor and control physical processes, devices and industrial infrastructure — such as production lines, turbines, pumps and valves. Unlike IT, focused on data and information, OT acts on the physical world, where a failure can stop production or cause material damage and threaten life.

ICS (Industrial Control System)

An umbrella term for the systems that control industrial processes, encompassing SCADA, DCS (Distributed Control Systems) and PLCs. They are the heart of automation in manufacturing, energy, oil & gas and sanitation plants, and the central target of industrial cybersecurity.

SCADA (Supervisory Control and Data Acquisition)

A supervision and control system that collects data from remote sensors and controllers and allows operators to monitor and command the process from centralized screens. Because of its position of visibility and command, it is a priority target of attacks that seek to manipulate the process or blind the operator.

PLC (Programmable Logic Controller)

A rugged industrial computer that executes control logic in real time, reading sensors and driving actuators on the shop floor. Many legacy PLCs have no native authentication or encryption, accepting commands from any device on the network — which is why protection comes from segmentation, not from agents installed on the controller itself.

Purdue model

A reference architecture (Purdue/ISA-95) that organizes industrial environments into hierarchical levels (0 to 5) plus the industrial DMZ, defining that each level communicates only with adjacent ones. It is the basis of segmentation, zones and conduits in the defense in depth of OT networks, adopted by IEC 62443.

IIoT (Industrial Internet of Things)

The set of sensors, meters, cameras and connected devices that bring telemetry and intelligence to the industrial operation. When deployed with default passwords, without updates or with exposed management ports, they broaden the attack surface and become a frequent vector of OT compromise.

Por onde começar

1. Map your exposure for free: start the Threat Management plan at decripte.com.br/intelligence-center to see vulnerabilities, external exposure and active threats against your organization before any investment.
2. Inventory OT assets passively: discover all PLCs, HMIs, SCADA, IIoT gateways and engineering workstations by listening to mirrored traffic (SPAN/TAP), without injecting packets that could disturb sensitive controllers.
3. Build the communication map: document which devices talk to each other, in which protocols (Modbus, DNP3, EtherNet/IP, PROFINET, OPC) and at what volume, to have the real floor plan of the industrial network.
4. Segment IT and OT by the Purdue model: define zones and conduits per IEC 62443, implement the industrial DMZ between levels 3 and 4 and eliminate shortcuts that connect the corporate network directly to the shop floor.
5. Set up OT vulnerability management: cross-reference the inventory with CISA advisories, CERT.br alerts and CVEs, prioritize by real risk and apply compensating controls where the patch cannot be installed immediately.
6. Activate passive monitoring and a 24x7 SOC: detect anomalous commands to PLCs, unauthorized devices and IT/OT lateral movement, correlating with MITRE ATT&CK for ICS and threat intelligence.
7. Control vendor remote access: implement strong authentication, monitored and recorded sessions, just-in-time access and automatic revocation at the end of each third-party service.
8. Have a safety-first incident response plan: prepare OT playbooks that prioritize network isolation over physical shutdown, and engage a response triggered in under 1 hour to reduce plant downtime.

Perguntas frequentes