Cyber security of OT networks: A tutorial, survey of attacks and overview of current state of defense tools, protocols, & challenges

Abstract

The convergence of Operational Technology (OT) and Information Technology (IT) under Industry~4.0 has widened the cyber-attack surface of critical infrastructure across manufacturing, energy, transportation, water, and healthcare. This survey synthesizes OT/IT cybersecurity along four axes. First, we taxonomize \emph{attack vectors} that traverse the IT--OT boundary, separating IT-side initial access (phishing, exploits, supply-chain compromise, exposed remote access) from OT-side propagation and impact (insecure protocols, weak authentication, firmware tampering, control-logic manipulation). Second, we review \emph{defensive technologies} -- signature-based intrusion detection, AI/ML anomaly detection, Zero Trust Architecture, blockchain-based event logging, digital twins, and OT-aware Security Operations Centers -- and identify remaining \emph{gaps}: OT-specific patch management, dataset scarcity for ML, IoMT segmentation, and the absence of consistent resilience metrics. Third, we compile a cross-validated \emph{historical record} of 69 high-impact incidents spanning 2010--2025, from Stuxnet to Jaguar Land Rover, and quantify their \emph{commercial effects} sector by sector using figures sourced from SEC filings, government post-incident reviews, and primary regulatory disclosures. Fourth, we map the \emph{regulatory landscape}: NIST Cybersecurity Framework2.0 and SP~800-82~Rev.~3, IEC~62443, the EU NIS2 Directive, DORA, the Cyber Resilience Act, NERC~CIP, and healthcare-specific regimes (IEC-80001-1, FDA, NIST-SP-1800-8). A sectoral deep-dive on healthcare illustrates the IT--OT convergence threat model under high-consequence conditions. The result is a single, source-traceable reference on where OT/IT cybersecurity stands, what the historical record costs defenders who lag, and where investment yields the highest marginal return on resilience.