OWASP OT Top 10
The ten biggest security risks for operational technology: the systems that run factories, utilities, buildings and other physical processes. Each in plain words, why it matters, how to reduce it, and the full original text.
Your progress
Saved only in this browser.
Find the risks in a plant
Explore the site
Ten risks are hiding in this plant.
Hover or tap a red dot to see which OWASP OT Top 10 risk lives there. Use Tab and Enter on a keyboard.
OT risk 1 of 10 · The shed with a forgotten PC and a supplier's 4G modem
Unknown Assets and Unmanaged External Access
You cannot protect what you do not know you have.
Read risk 1OT risk 2 of 10 · The PLC cabinet still on old firmware
Devices with Known Vulnerabilities/Issues
A published weakness is an open invitation, especially if it can be reached.
Read risk 2OT risk 3 of 10 · The supplier's van at the gate
Inadequate Supplier/Supply Chain Management
Attackers sometimes come in through the people you trust most.
Read risk 3OT risk 4 of 10 · The production line that must never stop
Loss of Availability
In OT, if it stops (or lies), people can get hurt.
Read risk 4OT risk 5 of 10 · The control room door and its shared code
Insufficient Access Control
Shared passwords on a sticky note are not access control.
Read risk 5OT risk 6 of 10 · The camera and the screens nobody watches
Missing Incident Detection/Reaction Capabilities
The longer an intruder goes unnoticed, the worse it gets.
Read risk 6OT risk 7 of 10 · The wall between office IT and the plant
Broken Zones and Conduits Design
Split the site into rooms with controlled doorways, not one big open hall.
Read risk 7OT risk 8 of 10 · The contractor on site
Missing Awareness
The best lock is useless if nobody knows it is there, or why to use it.
Read risk 8OT risk 9 of 10 · The old radio link on the tanks
Components/Protocols with Insufficient Security Capabilities
Do not build tomorrow's site on yesterday's insecure parts.
Read risk 9OT risk 10 of 10 · The server rack with open USB ports
Missing Hardening
Switch off what you do not need, and add a few extra locks.
Read risk 10The list
The 10 risks
OWASP ranking
Top 4: fundamental
There was consensus that these are fundamental for OT security.
You cannot protect what you do not know you have.
02 Devices with Known Vulnerabilities/IssuesA published weakness is an open invitation, especially if it can be reached.
03 Inadequate Supplier/Supply Chain ManagementAttackers sometimes come in through the people you trust most.
04 Loss of AvailabilityIn OT, if it stops (or lies), people can get hurt.
OWASP ranking
Similar high importance
Items 5 to 9 were all deemed to be of similar high importance.
Shared passwords on a sticky note are not access control.
06 Missing Incident Detection/Reaction CapabilitiesThe longer an intruder goes unnoticed, the worse it gets.
07 Broken Zones and Conduits DesignSplit the site into rooms with controlled doorways, not one big open hall.
08 Missing AwarenessThe best lock is useless if nobody knows it is there, or why to use it.
09 Components/Protocols with Insufficient Security CapabilitiesDo not build tomorrow's site on yesterday's insecure parts.
OWASP ranking
The final item
Not a security issue by itself, but it would have prevented many incidents.