Electricity serves an important part to the economy and to people’s day-to-day activities. A power grid that fails can cause catastrophic damages.

For industrial and corporate giants, data has been incredibly useful to provide daily insights for improvement everywhere. Thus, OT gradually converges with IT, transforming the traditional operation model towards automation to improve productivity. However, convenience and productivity have introduced more attack vectors to the OT environment and created more opportunities for malicious activities. OT systems which were designed many decades ago are now exposed to a lot of risk. 

Programmable logic controllers (PLCs) are the most important components of industrial control systems, providing the high performance and efficiency that is necessary for automation. They receive information from input devices (e.g. sensors), process the data, and conduct necessary actions based on pre-programmed parameters. These days, PLCs are also more integrated and interconnected with other complex systems and open source solutions.

Machinery these days are highly sophisticated and expensive, consisting of a lot of sensors, moving parts and computing power.
In the long term, they can produce high return on investment for companies, replacing manual workforce in critical areas that require high precision and productivity. However, when machines act as the brains for operation and are connected to a lot of industrial devices, a security breach can put the whole operation at stake.

The North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) is a set of standards developed by NERC, aimed to heighten the protection level of Bulk Electric System
(BES) cyber assets and to prevent potential instability and operational interruption. NERC CIP covers the United States, several provinces in Canada, and one state in Mexico. Failure to comply can lead to penalties up to $1 milliion USD per day depending on the violation severity. It also serves as reference for some regions that it does not directly apply to.