ot-ics-security-basics
Apply foundational OT/ICS security awareness — segmentation, safe change, vendor remote access, and availability-first constraints. Use when IT/OT boundaries exist, or when securing industrial and operational technology environments at a basic program level.
- License 许可
- MIT
- 最近更新
- 2026-07-22
- Stars
- ★ 7
- Forks
- 1
01 前言 Front Matter
- name
- ot-ics-security-basics
- description
- Apply foundational OT/ICS security awareness — segmentation, safe change, vendor remote access, and availability-first constraints. Use when IT/OT boundaries exist, or when securing industrial and operational technology environments at a basic program level.
03 SKILL.md 正文
OT / ICS Security Basics
Overview
Operational technology prioritizes safety and availability differently from typical IT. Controls must respect process uptime, legacy systems, and physical consequences.
When to Use
- IT/OT network boundary design
- Vendor remote access into plants or facilities
- Basic OT asset inventory and patch strategy
- Bridging IT security teams into OT contexts
Core Practices
- Inventory OT assets and data flows across the IT/OT boundary
- Segment OT networks; control and monitor conduits
- Manage vendor remote access tightly (time-bound, monitored)
- Patch and change with process-safety awareness
- Prefer passive monitoring where active scanning is risky
- Coordinate incident response with operations and safety roles
Principles
- “Just scan it like IT” can cause outages or safety issues
- Availability and safety may outrank confidentiality in prioritization
- Legacy embedded devices often cannot run modern agents
- Physical access is part of the threat model
Verification
- [ ] IT/OT boundary and conduits are documented
- [ ] Vendor access is controlled and reviewed
- [ ] OT changes follow an appropriate change process
04 同仓库更多 Skills
compliance-monitoring
Design compliance monitoring and testing programs that verify controls work in practice and surface issues before regulators do. Use when building monitoring plans, compliance testing, or continuous control monitoring.
complaints-handling
Operate complaints-handling processes that meet regulatory standards — logging, timely resolution, root-cause analysis, and fair outcomes. Use when designing or improving regulated complaints frameworks or analyzing complaint themes for conduct risk.
aml-kyc-basics
Apply AML/KYC fundamentals — customer due diligence, monitoring, suspicious activity escalation, and recordkeeping — for financial crime compliance. Use when designing onboarding controls, transaction monitoring concepts, or AML program components in financial services.
ai-model-compliance
Apply compliance controls to AI and automated decision systems — transparency, fairness, human oversight, documentation, and regulatory alignment. Use when deploying AI in regulated processes (credit, fraud, customer decisions) or responding to AI governance expectations.
data-quality-management
Manage data quality end-to-end — dimensions, rules, remediation, and prevention — beyond one-off cleaning scripts. Use when building sustained data quality programs or fixing systemic accuracy, completeness, or consistency problems.
data-lineage
Capture and use data lineage — where data comes from, how it transforms, and what depends on it — for impact analysis, debugging, and trust. Use when tracing metric origins, assessing change impact, or diagnosing broken pipelines.