OT and ICS Security in Malaysia: Protecting Industrial Control Systems

Operational Technology (OT) security is one of the most urgent and underserved areas of cybersecurity in Malaysia. As industrial organisations — from energy utilities to water treatment facilities — connect their operational systems to enterprise IT networks, the attack surface expands dramatically. A breach in an OT environment does not just expose data: it can halt production, damage physical equipment, or threaten public safety. For Malaysian operators in NACSA-designated National Critical Information Infrastructure (NCII) sectors, getting OT security right is both a regulatory obligation and a matter of national resilience.

IT security vs OT security: why the distinction matters

IT security and OT security share common principles but operate under fundamentally different priorities. In IT, the security triad is Confidentiality, Integrity, Availability — in that order. In OT, the order is reversed: Availability comes first, because a production system that goes offline has immediate operational and economic consequences. Safety comes before confidentiality in environments where a malfunctioning pump or valve can cause a physical incident.

OT environments are also characterised by legacy systems that were never designed with cybersecurity in mind. Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), and Distributed Control Systems (DCS) often run on proprietary operating systems, use industrial protocols such as Modbus, DNP3, and PROFINET, and have operational lifespans of 15 to 30 years. Patching these systems is rarely straightforward — in many cases, a vendor patch requires a full production shutdown and a recertification cycle.

This combination of high availability requirements and legacy architecture means that standard IT security practices — aggressive patching schedules, endpoint detection agents, network scanning — can themselves cause disruptions in OT environments. A misconfigured active network scan can crash a sensitive PLC. Security teams must adapt their approach accordingly.

The Purdue model: OT network segmentation in practice

The Purdue Enterprise Reference Architecture, commonly called the Purdue Model, remains the foundational framework for structuring OT network security. It divides industrial environments into five levels:

• Level 0 — Field devices: Sensors, actuators, and physical process equipment.
• Level 1 — Control: PLCs, RTUs, and local control systems that directly manage field devices.
• Level 2 — Supervisory: SCADA systems and Human-Machine Interfaces (HMIs) that provide operator visibility.
• Level 3 — Operations: Manufacturing execution systems, historian databases, and site-level operations management.
• Level 4 — Enterprise IT: Business systems, ERP platforms, and corporate networks.

A demilitarised zone (DMZ) sits between Levels 3 and 4, acting as a controlled gateway. The security principle is simple: traffic should never flow directly between the enterprise IT layer and the operational layers without inspection and explicit authorisation. In practice, enforcing this boundary — particularly as organisations adopt cloud connectivity, remote access tools, and IoT devices — is where many Malaysian industrial operators face their greatest exposure.

IT/OT convergence: the expanding attack surface

The business case for IT/OT convergence is compelling. Connecting OT systems to enterprise networks enables real-time production monitoring, predictive maintenance, and data-driven operational decisions. The risks, however, are significant. When OT systems gain IP connectivity — even indirectly — they inherit all of the threat landscape that enterprise IT faces, while retaining the legacy vulnerabilities of OT. This convergence is the primary driver of the sharp increase in OT-targeted attacks globally since 2020.

Common IT/OT convergence risks in Malaysian industrial environments include:

• Flat network architecture: OT systems connected to corporate networks without meaningful segmentation, allowing lateral movement from a compromised laptop to a SCADA console.
• Third-party vendor access: Remote maintenance access granted to OT equipment vendors, often through poorly secured VPN accounts with excessive privileges.
• Unmanaged asset sprawl: IoT sensors and connected devices added to OT networks without proper inventory tracking or security review.
• Shadow IT in OT: Engineering workstations running personal software, using USB drives, or connecting to the internet outside of change-control processes.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has documented multiple campaigns in which threat actors used IT network footholds to pivot into OT environments — including the 2021 Oldsmar water treatment facility incident, where an attacker briefly altered chemical dosing levels via remote access. Malaysian operators cannot assume geographic distance provides protection from nation-state or sophisticated criminal actors.

OT threats relevant to Malaysian NCII sectors

Malaysia’s National Cyber Security Agency (NACSA) designates 11 National Critical Information Infrastructure sectors — including Energy, Water, Transportation, Banking and Finance, and Health Services. Operators in these sectors face a threat landscape that is growing more targeted and technically sophisticated each year.

Ransomware targeting OT environments

Ransomware groups have evolved from targeting IT systems to actively seeking out OT environments. The Colonial Pipeline attack in 2021 — which disrupted fuel supply to the US East Coast — was caused by ransomware in the IT environment that prompted the operator to proactively shut down OT systems as a precaution. More recent variants, including those tracked under the MITRE ATT&CK for ICS framework, include modules specifically designed to identify and manipulate industrial control systems before deploying encryption. For Malaysian energy and utilities operators, a successful ransomware deployment that reaches OT systems could trigger NACSA incident reporting obligations under the national cybersecurity framework.

State-sponsored sabotage and espionage

Advanced Persistent Threat (APT) groups — many attributed to nation-state actors — have demonstrated sustained interest in infiltrating critical infrastructure OT environments not to cause immediate disruption, but to pre-position for future operations. The VOLT TYPHOON campaign, disclosed by multiple government agencies in 2024, revealed that attackers had maintained years-long persistence in US critical infrastructure OT networks. ASEAN nations, including Malaysia, are not immune to similar campaigns targeting telecommunications, energy, and government OT systems.

Supply chain and vendor compromise

OT vendors and system integrators typically require persistent remote access to perform maintenance and updates. This access, if not tightly controlled, represents a trusted pathway into otherwise isolated OT networks. Compromising a single vendor with access to multiple industrial customers enables attackers to scale their operations efficiently. Malaysian manufacturers and utilities that rely on international OT equipment vendors must enforce strict vendor access controls, including just-in-time access provisioning and session recording.

Monitoring OT environments: passive detection without disruption

Effective OT security monitoring requires a fundamentally different approach from IT. Passive network monitoring — where traffic is mirrored to a sensor via a SPAN port or network TAP without injecting any active probes — is the standard methodology. This allows security teams to build a complete asset inventory, identify industrial protocol anomalies, and detect lateral movement without any risk of disrupting PLCs or real-time control loops.

OT-aware monitoring platforms decode industrial protocols natively, distinguishing between normal SCADA poll-response cycles and unexpected command writes that could indicate unauthorised control activity. This telemetry is then fed into a Security Operations Centre (SOC) with analysts trained to interpret both IT and OT threat contexts. Simply Data operates a managed SOC with OT visibility capability, providing 24/7 monitoring, threat detection, and incident response for Malaysian industrial operators.

Key monitoring use cases for OT environments include:

• Detecting new or rogue devices joining OT network segments
• Alerting on engineering workstations establishing unusual external connections
• Identifying unauthorised command writes to PLCs or changes to control logic
• Flagging remote access sessions outside approved maintenance windows
• Correlating OT anomalies with concurrent IT-side indicators of compromise

For organisations that need to start with a foundational layer of protection, managed network security services can establish the necessary segmentation, firewall policy enforcement, and traffic monitoring baseline before a full OT-specific programme is deployed.

The NACSA regulatory context: what Malaysian operators must do

NACSA’s NCII Sector Risk Assessment framework requires operators in designated sectors to conduct regular risk assessments, implement baseline cybersecurity controls, and report significant incidents to NACSA within mandated timeframes. Malaysia’s Cyber Security Act 2024 — gazetted in August 2024 — strengthened NACSA’s enforcement powers and introduced licensing requirements for cybersecurity service providers, signalling a clear intent to raise the baseline of cybersecurity maturity across critical sectors.

For organisations in the financial sector, Bank Negara Malaysia’s Risk Management in Technology (RMiT) policy imposes additional requirements around technology risk governance that extend to OT-adjacent systems used in financial operations and data centre infrastructure. Compliance with both NACSA and RMiT frameworks is not mutually exclusive — a structured OT security programme addresses the risk management, monitoring, and incident response requirements of both.

Conducting a formal NCII Sector Risk Assessment is the recommended starting point for any Malaysian organisation seeking to understand its OT risk posture and map its security gaps against NACSA’s baseline requirements. The Simply Data consultancy team delivers structured risk assessments aligned to the NACSA framework, producing a prioritised remediation roadmap that addresses both IT and OT risk domains.

Building an OT security roadmap: where to start

For most Malaysian industrial organisations, the path to OT security maturity follows a clear sequence. The starting point is always visibility: you cannot protect what you cannot see. A comprehensive OT asset discovery exercise — using passive scanning to avoid disruption — establishes the asset inventory that all subsequent security decisions depend on.

From there, network segmentation enforcement (or remediation of flat network architecture) is the highest-impact structural control. Applying the Purdue Model’s zoning principles, enforced by next-generation firewalls with industrial protocol inspection, significantly reduces the blast radius of any IT-side compromise. Vendor access controls, implemented through a privileged access management solution with session recording, address the third-party risk dimension.

Continuous monitoring and incident response complete the programme. OT security incidents are fundamentally different from IT incidents in their potential consequences — a well-prepared response playbook that accounts for the operational constraints of OT environments (no arbitrary shutdown of safety systems, coordination with engineering teams, regulatory notification obligations) is essential before, not after, an incident occurs.

Protect your organisation with Simply Data

Simply Data works with Malaysian industrial operators, utilities, and critical infrastructure organisations to build OT security programmes that are operationally realistic and aligned to NACSA requirements. From risk assessment and network segmentation design through to 24/7 managed SOC monitoring with OT visibility, our team has the technical depth and Malaysian regulatory context to support your programme end to end.

Start with a structured NCII Sector Risk Assessment to understand your current OT risk posture and regulatory gaps. Contact us today to speak with a Simply Data OT security specialist and take the first step toward securing your operational environment.

Frequently Asked Questions

What is OT security and why is it different from IT security?

OT (Operational Technology) security protects the hardware and software that monitors and controls physical industrial processes — such as power grids, water treatment plants, and manufacturing lines. Unlike IT security, which prioritises data confidentiality, OT security prioritises availability and safety: a system outage or sabotage can cause physical damage, environmental harm, or even loss of life. OT environments also run legacy systems with lifecycles measured in decades, making patching and modern security controls far more complex to implement.

What are the main cyber threats to industrial control systems (ICS)?

The most significant ICS threats include ransomware targeting operational systems to extort organisations, state-sponsored sabotage aimed at disrupting critical national infrastructure, supply-chain compromises through third-party vendors with remote OT access, and IT/OT convergence risks where internet-connected IT networks serve as a bridge for attackers to pivot into isolated OT environments. The MITRE ATT&CK for ICS framework documents over 80 techniques used specifically against industrial control systems.

Which Malaysian industries are classified as critical national information infrastructure (NCII)?

Malaysia’s National Cyber Security Agency (NACSA) identifies 11 NCII sectors under the national cybersecurity framework: Government, Banking and Finance, Transportation, Defence and Security, Information and Communications, Energy, Water, Health Services, Food and Agriculture, Emergency Services, and the Space sector. Operators in these sectors are subject to NACSA’s NCII Sector Risk Assessment framework and are expected to implement baseline cybersecurity controls for both IT and OT environments.

What is the Purdue Model and is it still relevant for OT security?

The Purdue Model (also called the Purdue Enterprise Reference Architecture or ISA-95) is a hierarchical framework that divides industrial environments into five levels — from field devices and sensors at Level 0 up to enterprise IT systems at Level 4, with a demilitarised zone (DMZ) separating IT and OT. While it was developed in the 1990s, the model remains the dominant reference architecture for OT network segmentation. Modern adaptations extend it to address cloud connectivity and IT/OT convergence, but the core principle — strict boundary control between IT and OT zones — is still a cybersecurity best practice in 2026.

How do you monitor OT networks for threats without disrupting operations?

Passive network monitoring is the industry-standard approach for OT environments. Specialised OT security platforms use passive traffic mirroring (SPAN ports) to inspect industrial protocols such as Modbus, DNP3, and PROFINET without sending any active probes that could disrupt sensitive PLCs or RTUs. This telemetry is fed into a Security Operations Centre (SOC) with OT-aware detection rules. The approach provides asset inventory, anomaly detection, and threat alerts without any operational downtime risk.

Is there a regulatory requirement for OT security in Malaysia?

Yes. NACSA’s National Cyber Security Policy and the NCII Sector Risk Assessment framework impose cybersecurity obligations on operators of critical infrastructure across 11 designated sectors. Bank Negara Malaysia’s Risk Management in Technology (RMiT) policy extends requirements to the financial sector’s OT-adjacent systems. Additionally, Malaysia’s Cyber Security Act 2024, gazetted in August 2024, introduces licensing requirements for cybersecurity service providers and strengthens enforcement powers for NACSA, with specific provisions covering critical information infrastructure protection.