Background Image

Cyber-Physical System Security Glossary

Claroty's CPS Security Glossary includes industry terms and definitions, along with additional resources, that provide a foundational understanding of multiple components of cybersecurity.

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Search Glossary Terms:

A

Active Monitoring

Active monitoring works by sending test traffic into the network and polling endpoints with which it comes into contact. By sending packets directly to endpoints, active scanning can be faster in collecting data, but this also increases the risk of endpoint malfunction by pushing incompatible queries to them or saturating smaller networks with traffic.

Related Resources

Blog Post: 7 Ways to Improve Asset Visibility
Blog Post: Feature Spotlight: Claroty Active Queries
White Paper: Evaluation Criteria for Choosing an ICS Cybersecurity Monitoring System

Air Gapped

An air gap, air wall, or air gapping is a network security measure employed on one or more computers to ensure that a secure computer network is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network.

Related Resources

Blog Post: How to Better Protect Air-Gapped Federal Critical Infrastructure
Blog Post: Aerospace Cybersecurity: Protecting the Skies in the Digital Age
Report: The Journey to Cyber-Physical Systems Security

Asset Discovery

Asset discovery refers to the process of identifying all hardware, software, and XIoT assets within an organization's OT environment. You can’t protect what you can’t see, that’s why asset discovery is foundational not only to cyber resilience but to an organization’s entire CPS cybersecurity journey.

Related Resources

Blog Post: OT Asset Discovery: 5 Steps to Gain Visibility for Your Network Assets
Blog Post: Feature Spotlight: ICS Asset Discovery Methods
Blog Post: 7 Ways to Improve Asset Visibility

Asset Inventory

An asset inventory refers to a comprehensive list of all hardware, software, and XIoT assets within an organization’s OT environment. Having a complete asset inventory is essential in an organization’s overall CPS security strategy as it provides the foundation for identifying vulnerabilities, and implementing the proper security controls to defend against cyberthreats.

Related Resources

Blog Post: 7 Ways to Improve Asset Visibility
Blog Post: OT Asset Discovery: 5 Steps to Gain Visibility for Your Network Assets
Blog Post: Feature Spotlight: ICS Asset Discovery Methods

Asset Management

Asset management refers to the systematic process of inventorying, tracking, and managing all the physical and digital assets within an OT environment. This includes devices, systems, software, and data that are part of the industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, and other OT networks.

Related Resources

Case Studie: Connected Asset Management through Real-Time Visibility at Yale New Haven Health System
Blog Post: Best Practices for Securing Industrial Environments, Part 5: Control Access

B

Breach and Attack Simulation

A security testing methodology that continuously emulates real-world attack paths against an organization's environment to validate defenses and identify weaknesses.

Building Automation Systems (BAS)

Building automation systems (BAS) are a network of connected devices that monitor and control a building's environment. BAS can include systems such as HVAC, lighting, security access and cameras, and alarms.

Related Resources

Blog Post: Extended Internet of Things (XIoT) FAQ
Blog Post: The 2026 Cybersecurity Guide to Industrial Control Systems
Report: The Ultimate Buyer's Guide for Industrial Cybersecurity Platforms

Building Management Systems (BMS)

A building management system (BMS), which is at times also referred to as a building automation system (BAS) or building control system (BCS), is a type of cyber-physical system (CPS) designed to control, monitor, manage, and optimize various aspects of building operations.

Related Resources

Blog Post: The Power of Building Management System (BMS) Cybersecurity
Blog Post: BMS 101: Securing Healthcare Building Management Systems
Blog Post: Securing Building Management Systems to Ensure Process Integrity

C

Common Vulnerabilities and Exposures (CVE)

Common Vulnerabilities and Exposures (CVE) is a dictionary-type list of standardized names for vulnerabilities and other information related to security exposures. CVE aims to standardize the names for all publicly known vulnerabilities and security exposures.

Related Resources

Blog Post: Unlocking the Power of Risk-Based Vulnerability Management (RBVM)
Blog Post: A Comprehensive Guide to Medical Device Vulnerability Management
Blog Post: A Comprehensive Guide to Exposure Management for Cyber-Physical Systems

Common Vulnerability Scoring System (CVSS)

The industry-standard framework for rating the severity and impact of cybersecurity vulnerabilities.

Confidentiality, Integrity, Availability (CIA Triad)

A foundational model in cybersecurity that guides policies and measures designed to protect data and information systems by maintaining its privacy (confidentiality), preventing unauthorized alterations (integrity), and ensuring reliable access for authorized users (availability).

Configuration Management Database (CMBD)

Configuration management database (CMDB) is a database that contains all relevant information about the hardware and software components used in an organization's IT services and the relationships between those components.

Related Resources

Datasheet: Continuous Threat Detection (CTD)
Report: The Global Healthcare Cybersecurity Study 2023
Report: The Journey to Cyber-Physical Systems Security

Continuous Diagnostics Mitigation (CDM)

Continuous Diagnostics and Mitigation (CDM) is a US Federal government program that enables Federal agencies with tools, services and visualization/dashboards for securing their networks. The key goals of the program include reduced attack surface, improved response to attacks, increased visiblity into federal cybersecurity, and streamlined FISMA reporting.

Continuous Threat Exposure Management (CTEM)

An approach or program that continuously identifies, assesses, prioritizes, and helps remediate risks, vulnerabilities, and exposures within cyber-physical environments to reduce risk and uphold operational integrity.

Cyber Hygiene

Cyber Security Hygiene is a colloquial term referring to best practices and other activities that computer system administrators and users can undertake to improve their cybersecurity while engaging in common online activities, such as web browsing, emailing, etc.

Related Resources

Blog Post: Top 5 Best Practices for Good Cyber Hygiene
Blog Post: 5 Best Practices to Maintain a Healthy Clinical Network
Blog Post: 7 Best Practices for Effective Healthcare Cybersecurity

Cyber-Physical System Protection Platform (CPS PP)

The Cyber-Physcial Systems (CPS) Protection Platform (PP) market is defined by Gartner as “products and services that use knowledge of industrial protocols, operational/production network packets or traffic metadata, and physical process asset behavior to discover, categorize, map and protect CPS in production or mission-critical environments outside of enterprise IT environments.”

Related Resources

Report: A Non Zero-Sum Game
Webinar: Breaking Barriers: Redefining Traditional CPS Security Strategies
Page: Platform

Cyber-Physical Systems (CPS)

Cyber-physical systems are defined by Gartner as engineered systems that orchestrate sensing, computation, control, networking and analytics to interact with the physical world — resulting in improved operations, resilient, reliable systems, and a deeper understanding of the physical things they control.

Related Resources

Blog Post: The Ultimate Guide to Cyber Physical Systems (CPS) Security
Blog Post: 10 Examples of Cyber-Physical Systems
Blog Post: Gartner® Market Guide for CPS Protection Platforms

Cybersecurity Capability Maturity Model (C2M2)

A US Department of Energy (DOE) framework for evaluating and improving cybersecurity capabilities, often referenced in compliance.

D

Data Diode

A hardware device that allows data to pass in only one direction, ensuring one-way data flow for security or data protection purposes.

Deep Packet Inspection (DPI)

Deep packet inspection (DPI) is a type of data processing that inspects in detail the data being sent over a computer network and usually takes action by blocking, re-routing, or logging it accordingly. There are multiple ways to acquire packets for deep packet inspection.

Related Resources

White Paper: Why "Extreme Visibility" in Industrial Networks is No Longer Just a Nice-to-Have
Blog Post: External Threat Detection: A Story Of An Alert
Datasheet: Healthcare Threat Detection

Defense Critical Infrastructure

Defense Critical Infrastructure refers to any physical or digital system and asset that the Department of Defense (DoD) has identified as critical to its mission. Any impact to these systems will lead to incapacity or destruction and a debilitating impact on the department to project, support, and sustain military forces and operations.

Distributed Control System (DCS)

Distributed Control System (DCS) refers to a control system for a process or plant, wherein controller elements are not central in location, but are distributed throughout the system with each component sub-system controlled by one or more controllers. Each controller operates independently of others, but is interconnected with the rest through a high-speed communication network. The primary purpose of a DCS is to control complex, large, and geographically distributed applications in industrial processes.

Related Resources

Blog Post: The 2026 Cybersecurity Guide to Industrial Control Systems
Blog Post: IIoT 101: Guide to the Industrial Internet of Things
Blog Post: The Future of Critical Infrastructure Cybersecurity

Distributed Network Protocol (DNP3)

Communication protocol used in industrial automation and control systems for reliable device messaging.

DoD Risk Management Framework

The DoD Risk Management Framework (RMF) is a set of guidelines that the U.S. Department of Defense (DoD) has designed and implemented to manage information security risks in the Department's systems. This framework provides a structured, flexible process for managing the security and privacy risks associated with the operation and use of information systems and technology by identifying and assessing risks, implementing appropriate security controls to mitigate them, and continuously monitoring and improving information security.

DoD Zero Trust Reference Architecture

The DoD Zero Trust Reference Architecture is a prescriptive architecture to enable the DoD to secure and defend their information and OT systems within the JIE and DoDIN, including defense critical infrastructure (DCI) against malicious cyber activity including advanced attacks. The goals are to detect, deter, deny, defend and recover from malicious cyber activity and to have a scalable, resilient, auditable and defendable framework that can be used across DoD DCI, data, applications, assets and services (DAAS). Rolled out in phases, it begins with 91 Target levels for adoption by 30 September 2027, and is followed by Advanced levels that DoD branches must meet.

Related Resources

Blog Post: Five Ways to Overcome Challenges Securing OT systems with the DoD ZTRA
Datasheet: Mapping to the DoD Zero Trust Reference Architecture

E

Engineering Workstation (EWS)

A specialized computing platform used by engineers for configuring, maintaining, and diagnosing control system applications.

Exposure Management

The term exposure refers to the state of being susceptible to potential cyber attacks due to vulnerabilities or weaknesses within an organization's CPS environment. Due to a growing attack surface, critical infrastructure organizations have been left with various points of exposure that an adversary can exploit. These entry points may lead to an attacker gaining unauthorized access, disrupting essential services, or causing various other forms of harm.

Related Resources

Blog Post: A Comprehensive Guide to Exposure Management for Cyber-Physical Systems
Blog Post: How Health Delivery Organizations Can Approach Exposure Management
Blog Post: Inside Claroty's Enterprise Management Console (EMC)

Extended Internet of Things (XIoT)

The XIoT refers to all connected assets that underpin cyber-physical systems (CPS) in industrial, healthcare, and commercial environments. It has emerged as a side effect of digital transformation and, thus, has escalated interconnectivity between the internet and assets that control physical processes.

Related Resources

Blog Post: Extended Internet of Things (XIoT) FAQ
Blog Post: The Healthcare XIoT: Key Concepts to Understand
Blog Post: How XIoT Cybersecurity Enables Your Business

F

Facility-Related Control System (FRCS)

Facility-Related Control System (FRCS) refers to the control systems that enable essential utilities, including humidity control, fire protection, temperature, electrical, mechanical, etc, the controlling devices for these systems, and standard IT that work together to achieve an objective. FRCS cybersecurity refers to protecting these access controls from bad actors seeking to exploit this system, resulting in blocking the objective. Examples include providing heating and cooling and maintaining a specific pressure or temperature.

Flyaway (Expeditionary) Kits

Known by the names of Hunt kits, Assessment kits, DCO kits, Flyaway kits, SOC in a Box, Expeditionary kits and Mobile Air Cyber Kits, these mobile, modular kits with small form factors are meant to enable operators to assess DoD networks for cybersecurity weaknesses or gaps. They contain hardware and software outfitted to meet the specific operational teams' goals to set up and conduct their cyber missions, provide feedback to reduce the attack surface and then re-deploy swiftly to the next site. The value is to reduce the need for in-field experts by flying in experts short-term to provide a swift, thorough and insightful analysis while still ensuring the utmost protection of the Federal networks they analyze.

Related Resources

Blog Post: Flyaway Kits: Key Benefits and Use Cases

H

Healthcare Cybersecurity

Healthcare cybersecurity refers to the protection of sensitive patient data, medical devices and assets, and other critical healthcare infrastructure from cyberattacks. Healthcare cybersecurity is critical to ensuring the availability of medical services, efficient operation of medical systems and equipment, and compliance with industry regulations for the safety and privacy of patients.

Related Resources

Report: The Ultimate Buyer's Guide for Healthcare Cybersecurity Platforms
Report: The Global Healthcare Cybersecurity Study 2023
Blog Post: The Healthcare XIoT: Key Concepts to Understand

Healthcare Delivery Organizations (HDOs)

Healthcare Delivery Organizations (HDOs) are institutions or systems that provide medical services, care, or treatments. They can encompass a variety of facilities including hospitals, clinics, rehabilitation centers, and specialized care providers.

Related Resources

Blog Post: How Health Delivery Organizations Can Approach Exposure Management
Blog Post: The Change Healthcare Cyber Attack: What It Means for Your Healthcare Delivery Organization
Blog Post: The Healthcare XIoT: Key Concepts to Understand

Human Machine Interface (HMI)

Human Machine Interface (HMI) is a user interface or dashboard that connects a person to a machine, system, or device. While the term can technically be applied to any screen that allows a user to interact with a device, HMI is most commonly used in the context of an industrial process.

Related Resources

Report: An Open Door
Webinar: Team82: A Simulation of an Industrial OT Attack
Blog Post: The Ultimate Guide to Cyber Physical Systems (CPS) Security

I

Indicators of Compromise (IoCs)

Indicators of Compromise (IoCs) is forensic evidence of potential intrusions on a host system or network.

Related Resources

Blog Post: External Threat Detection: A Story Of An Alert
Blog Post: Addressing Hospital Risk Management With Advanced Anomaly & Threat Detection
Blog Post: Overcoming Barriers to Effective OT Alert Management

Industrial Control Systems (ICS)

Industrial control systems can be defined as a collection of hardware and software systems, networks, and controls that are designed to monitor, control, operate, and/or automate industrial processes. These systems are present in various different critical infrastructure industries including chemical, electric, oil & gas, manufacturing, transportation, and more.

Related Resources

Blog Post: The 2026 Cybersecurity Guide to Industrial Control Systems
Blog Post: ICS Security: The Purdue Model
White Paper: Claroty Support for the MITRE ATT&CK for ICS Framework

Industrial Cybersecurity

Industrial cybersecurity refers to the protection of critical infrastructure, including manufacturing plants, power grids, chemical plants, and other industrial control systems (ICS) from cyber attacks. Industrial cybersecurity is critical because an attack can have severe consequences such as production downtime, physical damage, environmental damage, or even in extreme cases, loss of life.

Related Resources

Blog Post: Global Industrial Cybersecurity Study Reveals Challenges and Priorities Amid Persistent Ransomware Threats
Blog Post: The 2026 Cybersecurity Guide to Industrial Control Systems
Blog Post: Industrial Risk Management 101

Industrial Internet of Things (IIoT)

The concept of the IIoT involves connecting sensors, instruments, and devices, within settings like manufacturing and energy management. Unlike the IoT, which focuses on consumers, the IIoT emphasizes improving efficiency facilitating machine-to-machine communication (M2M), and automating industrial processes. By incorporating analytics, artificial intelligence, and real-time data collection, the IIoT enables industries to achieve levels of productivity, performance, and predictive maintenance.

Related Resources

Blog Post: IIoT 101: Guide to the Industrial Internet of Things
Blog Post: IIoT Security: 5 Essential Steps to Secure your IoT Devices and OS
Blog Post: Global Industrial Cybersecurity Study Reveals Challenges and Priorities Amid Persistent Ransomware Threats

Information Security Management System (ISMS)

A structured framework of policies, processes, and controls designed to manage and protect an organization’s information assets, ensuring the confidentiality, integrity, and availability of its data.

Information Technology (IT)

IT involves the use of computer systems and devices to process, manage, protect, and exchange information. The major responsibility of IT systems is to manage the data and information used to support business operations. Examples of IT systems include servers, computers, software applications, databases, and other resources used for communication, data and information storage, and/or analysis.

Related Resources

Blog Post: IT vs OT Security: Key Differences In Cybersecurity
White Paper: The Critical Convergence of IT and OT Security in a Global Crisis
Blog Post: Key Limitations of IT-Centric Remote Access Solutions in OT

Internet of Battlefield Things

The Internet of Battlefield Things (IoBT) is a network of interconnected devices that connects soldiers with smart technology with the goal of improving efficiency, decision making, and enhancing military operations. The connected devices are key to sharing critical real-time information.

Internet of Medical Things (IoMT)

IoMT encompasses various wearable devices such as smartwatches that can track health metrics, remote patient monitoring such as blood glucose monitors or ECG machines, and medical imaging systems such as MRI machines or CT scanners. The data collected from IoMT devices can be used to improve patient outcomes, enhance the efficiency of healthcare delivery, and enable remote patient monitoring and telemedicine services.

Related Resources

Blog Post: IoMT 101: Guide to Internet of Medical Things Security
Webinar: An Integrated Approach to IoMT and Endpoint Security with Crowdstrike and Torrance Memorial
Report: The Ultimate Buyer's Guide for Healthcare Cybersecurity Platforms

Internet of Military Things

Internet of Military Things refers to the complex network of interconnected devices used for combat operations and warfare.

Internet of Things (IoT)

The Internet of things (IoT) is a system of interrelated computing devices, mechanical and digital machines provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction.

Related Resources

Blog Post: Medigate by Claroty Wins Best in KLAS for Healthcare IoT Security - Four Years in a Row
Blog Post: Complete Guide: Securing Healthcare IoT Devices
Blog Post: IIoT Security: 5 Essential Steps to Secure your IoT Devices and OS

ISA/IEC 62443 Framework

The ISA/IEC 62443 framework is a set of guidelines and requirements for all stakeholders in the design, implementation, and management of industrial control systems. It helps organizations establish a strong security posture, manage supply chain risks, enable compliance, and become more resilient against attackers.

Related Resources

Blog Post: What Is the ISA/IEC 62443 Framework?

K

Known Exploited Vulnerabilities (KEVs)

A publicly curated list of vulnerabilities that have been confirmed as actively exploited in the wild, maintained by CISA for prioritization.

M

Managed Detection and Response (MDR)

A cybersecurity service that provides continuous threat monitoring, detection, and response through human expertise and technology.

Management of Change (MOC)

Management of Change (MOC) is a practice used to ensure that safety and environmental risks are controlled when a company makes changes in their organization.

Related Resources

Blog Post: Top Strategies for OT Security Risk Management
Blog Post: Medical Device Risk Management: Protecting Patient Care
Blog Post: The Future of Critical Infrastructure Cybersecurity

Medical Device Security

Medical device security refers to the protection of medical devices and healthcare systems from cyberthreats. Due to IT/OT convergence, medical devices have become increasingly interconnected. Medical device security is critical for ensuring the safety and privacy of patients, protecting against threats, and ensuring the uninterrupted operation of medical devices and healthcare systems.

Related Resources

Blog Post: State of Medical Device Security: Cyber Risks and Solutions
Blog Post: Top 5 Reasons You Need a Device Security Partner
Blog Post: Medical Device Cybersecurity: HHS 405(d) Best Practices Update

MITRE Adversary Tactics, Techniques, and Common Knowledge (ATT&CK)

A globally accessible knowledge base based on real-world observations for mapping adversary tactics, techniques and procedures for threat modeling and security analysis.

Related Resources

White Paper: Claroty Support for the MITRE ATT&CK for ICS Framework
Blog Post: How Claroty Supports the MITRE ATT&CK for ICS Framework
Blog Post: MITRE ATT&CK for ICS Framework: Detecting Adversary Techniques

Modular Bus

A communication protocol used in industrial control systems for connecting devices like PLCs and sensors; its lack of inherent security makes it a target for attacks.

N

Network Access Control

A security framework that enforces policies determining which devices and users are allowed to connect to a network, based on identity and compliance status.

Network Intrusion Detection System

A system that monitors network traffic for suspicious patterns or known attack signatures and generates alerts.

Network Protection

Network protection refers to the strategies, activities, and measures designed to safeguard a network, the connected devices, as well as the network connectivity itself from threats and attacks. These threats could be from various sources such as hackers, viruses, malware, spyware, spam distribution, intrusion attempts, and unauthorized access.

Related Resources

White Paper: Implementing Zero Trust for Industrial Environments

Network Segmentation

Network Segmentation is an approach to technology network architecture that divides a network into multiple sub-networks that can be managed and secured separately. Effective network segmentation significantly limits the ability of threat actors.

Related Resources

Blog Post: How to Accelerate OT Industrial Network Segmentation
Blog Post: How to Accelerate Network Segmentation in DoD Networks
Webinar: Strategies for Effective Medical Device Segmentation: Insights from Bayhealth

NIST Cybersecurity Framework

A flexible guidance for managing and reducing cybersecurity risk in critical infrastructure, structured around core functions: Identify, Protect, Detect, Respond, Recover, and Govern; developed by the US National Institute of Standards and Technology.

Related Resources

White Paper: Claroty and the NIST Cybersecurity Framework (NIST CSF)
Page: Complying with the NIST Cybersecurity Framework
Blog Post: Decreasing Administrative Complexity with Secure Access

O

Operational Efficiency

Operational efficiency in healthcare refers to the effectiveness and competency in which a healthcare delivery organization (HDO) optimizes their resources and processes to deliver high-quality services to patients in a timely, cost-effective manner. It involves improving patient satisfaction, utilizing technologies effectively, reducing waste, streamlining processes, coordination among staff, and making data-driven decisions.

Related Resources

Datasheet: Operational Efficiency

Operational Technology (OT)

OT is responsible for managing and controlling physical devices that are typically involved in the production or delivery of goods and services. Examples of OT systems include industrial control systems (ICS), sensors, robotics, and others used in critical infrastructure industries.

Related Resources

Blog Post: IT vs OT Security: Key Differences In Cybersecurity
Blog Post: Claroty Named a Strong Performer in Forrester Wave for Operational Technology Security Solutions, Q2 2024
Blog Post: OT Asset Discovery: 5 Steps to Gain Visibility for Your Network Assets

OT Cybersecurity

Operational Technology (OT) cybersecurity refers to the practices, technologies, and processes designed to protect industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other OT environments from cyber threats and attacks. OT cybersecurity aims to ensure the safe, secure, and reliable operation of critical infrastructure and industrial processes.

Related Resources

Blog Post: IT vs OT Security: Key Differences In Cybersecurity
Blog Post: IoT Cybersecurity Improvement Act in Critical Infrastructure Companies
Blog Post: CISO Series: OT Security Best Practices and Recommendations

P

Passive Monitoring

Passive monitoring silently analyzes network traffic through a span port or tap to identify endpoints and traffic patterns. It creates no additional network traffic and has virtually no risk of disrupting critical processes by interacting directly with endpoints. However, passive monitoring can take more time to collect asset data as it must wait for network traffic to be generated to or from each asset to create a complete baseline profile.

Related Resources

Report: A Non Zero-Sum Game
White Paper: Evaluation Criteria for Choosing an ICS Cybersecurity Monitoring System
Page: Passive Monitoring - Platform

Process Field Bus

A standard fieldbus protocol used in industrial automation for communication between controllers and field devices; securing it is part of OT security.

Programmable Logic Controller (PLC)

A programmable logic controller (PLC) or programmable controller is an industrial digital computer which has been ruggedized and adapted for the control of manufacturing processes, such as assembly lines, or robotic devices, or any activity that requires high reliability control and ease of programming and process fault diagnosis.

Related Resources

Blog Post: The Top 5 Challenges in Manufacturing Cybersecurity
Blog Post: Next-Gen Defense: Cybersecurity in Smart Manufacturing
Blog Post: IIoT 101: Guide to the Industrial Internet of Things

Purdue Model

The Purdue Model was designed as a reference model for data flows in computer-integrated manufacturing (CIM). CIM is a manufacturing approach of using computers to control the entire production process — allowing operations to be faster and less error-prone. This model later came to define the standard for building an ICS network architecture that supports OT security by separating the layers of the network.

Related Resources

Blog Post: ICS Security: The Purdue Model
Blog Post: How to Accelerate OT Industrial Network Segmentation
Blog Post: Feature Spotlight: Claroty Virtual Zones

R

Ransomware as a Service (RaaS)

Ransomware as a Service (RaaS) is a subscription-based model that sells or rents predeveloped ransomware tools to buyers, called ransomware affiliates, to execute ransomware attacks.

Related Resources

Blog Post: Cyber Attack Overview: JBS Foods Ransomware Incident
Blog Post: Cyber Attack Overview: Colonial Pipeline Ransomware Incident
Blog Post: Global Industrial Cybersecurity Study Reveals Challenges and Priorities Amid Persistent Ransomware Threats

Remote Access

Remote access allows employees, contractors, and vendors of critical infrastructure organizations to remotely connect to the assets and systems that underpin their OT environment. As a result, these personnel are able to monitor, control, maintain, and troubleshoot equipment and processes without being on-premise at the facility.

Related Resources

Blog Post: The Ultimate Guide to OT Secure Remote Access
White Paper: Optimizing OT Remote Access for Third-Party Vendors with Claroty xDome Secure Access
Blog Post: Identifying Risks in Third-Party OT Remote Access

Remote Privileged Access Management (RPAM)

According to Gartner, “RPAM tools enable access for remote privileged users through session brokering, credential injection/vaulting and strong authentication capabilities, which mitigate many of the risks of unmanaged devices employed by those users. The tools also enable alignment with zero-trust architectures, because there is no implicit trust in corporate networks or endpoint devices.

Related Resources

Blog Post: Essentials of Zero Trust Adoption & Secure Access
Webinar: Zero Trust Meets Privileged Access for Enhanced Operational Resilience
Datasheet: Claroty xDome Secure Access

Remote Terminal Unit (RTU)

An electronic device situated in the field that connects to physical sensors and actuators, digitizes signals, and transmits data to supervisory control systems—commonly used in industrial and utility networks for remote monitoring and control.

Risk Management

Risk management refers to the process of identifying, assessing, and mitigating risks associated with hardware, software, and XIoT assets within an organization’s OT environment. Having an effective OT security risk management strategy begins with successfully identifying, assessing, and mitigating potential risks and vulnerabilities that can impact business objectives and operations.

Related Resources

Blog Post: Top Strategies for OT Security Risk Management
Blog Post: Unlocking the Power of Risk-Based Vulnerability Management (RBVM)
Blog Post: Medical Device Risk Management: Protecting Patient Care

S

Secure Access

The comprehensive strategies and technologies designed to ensure that only authorized users, devices, and systems can access certain resources, such as networks, applications, and data. This involves a combination of various security measures to prevent unauthorized access, protect sensitive information, and maintain the integrity and availability of systems.

Related Resources

Case Studie: xDome Secure Access Success Stories
White Paper: Optimizing OT Remote Access for Third-Party Vendors with Claroty xDome Secure Access
Blog Post: Essentials of Zero Trust Adoption & Secure Access

Security Information Event Management (SIEM)

Security information and event management (SIEM) combines Security Information Management (SIM) and Security Event Management (SEM) which provide real-time analysis of security alerts generated by applications and network hardware.

Related Resources

Datasheet: Choosing Vendors For Your Cyber Physical System (CPS) Security Ecosystem
Blog Post: CISO Series: Why Integrations Matter When Picking an OT Security Provider
Datasheet: Continuous Threat Detection (CTD)

Security Operations Center (SOC)

Security Operations Center (SOC) is an organized and highly skilled team whose mission is to continuously monitor and improve an organization's security posture while preventing, detecting, analyzing, and responding to cyber security incidents with the aid of both technology and well-defined processes and procedures.

Related Resources

White Paper: Five Essential Steps for a Converged IT/OT SOC
Datasheet: Common Healthcare SOC Team Challenges
Report: The Journey to Cyber-Physical Systems Security

Security Posture Assessment (SPA)

An evaluation of an organization's overall security readiness, including policies, controls, and vulnerabilities.

Software Bill of Materials (SBOM)

A formal, machine-readable inventory of all software components and dependencies in a product, used to track vulnerabilities and licensing.

Software Defined Perimeter (SDP)

A security framework that conceals infrastructure from unauthorized users by dynamically creating network boundaries, ensuring only authorized devices and users can access protected resources.

Supervisory Control and Data Acquisition (SCADA)

Supervisory Control and Data Acquisition (SCADA) is a computer system for gathering and analyzing real time data. They are used to monitor and control a plant or equipment in industries such as telecommunications, water and waste control, energy, oil and gas refining, and transportation.

Related Resources

Blog Post: A Comprehensive Guide to SCADA Cybersecurity
Blog Post: SCADA Risk Management: Protecting Critical Infrastructure
Blog Post: ICS/SCADA Vulnerability Management: Proactive Strategies for Cyber Resilience

T

Third-Party Risk (Healthcare)

Third-party risk involves identifying, evaluating, and controlling risk associated with third parties, such as vendors, medical device manufacturers, and contractors. Protecting your organization from third-party risk includes limiting access third-parties have to devices and assets, enabling controls, and establishing safeguards.

Related Resources

Blog Post: Medical Device Risk Management: Protecting Patient Care
Blog Post: 6 Considerations to Strengthen Risk Management in Healthcare

Third-Party Risk (Industrial)

Third-party risk in industrial environments encompasses risks including cybersecurity vulnerabilities, inconsistent security practices, operational disruptions, compliance issues, and the challenge of maintaining visibility and control. These risks stem from external vendors employing IT-centric tools that are ill-suited for the specific demands of OT systems, potentially leading to increased vulnerabilities and disruptions in critical infrastructure operations.

Related Resources

Blog Post: Key Benefits of Industrial Remote Access and Securing Cyber-Physical Systems
Blog Post: Introducing Claroty xDome Secure Access: Delivering Secure Access to All of Your Cyber-Physical Systems
Blog Post: Identifying Risks in Third-Party OT Remote Access

Threat Detection

Threat detection refers to the process of identifying potential security threats and vulnerabilities in an organization’s systems and networks. Effective threat detection requires a proactive approach to cybersecurity, which involves continuous monitoring and analysis of system and network activity.

Related Resources

Datasheet: 4 Keys to Success For Threat Detection in Healthcare
Blog Post: External Threat Detection: A Story Of An Alert
Datasheet: Healthcare Threat Detection Solution Overview

V

Visibility Orchestration

Visibility Orchestration simplifies the process of developing an accurate asset inventory by bringing transparency, simplicity, and automation to achieve the right level visibility quality, balancing with an organization's environmental, operational, and risk tolerance constraints. By abstracting the technical nuance and leveraging copilot machine learning techniques, visibility orchestration enable the most accurate results in the shortest amount of time and simplifies the deployment of those techniques.

Related Resources

Report: A Non Zero-Sum Game
Webinar: Breaking Barriers: Redefining Traditional CPS Security Strategies

Vulnerability Exploitability eXchange

A machine-readable document that communicates whether a product is affected by a specific vulnerability and whether the vulnerability is exploitable in that context.

Vulnerability Management

The cyclical, ongoing process of identifying, assessing, reporting on, and mitigating security vulnerabilities present within assets and devices. Vulnerabilities may either be mitigated by implementing patches or compensating controls. Since mitigating all vulnerabilities present in a given environment is virtually impossible, effective prioritization is key to effective vulnerability management.

Related Resources

Blog Post: A Comprehensive Guide to Medical Device Vulnerability Management
Blog Post: ICS/SCADA Vulnerability Management: Proactive Strategies for Cyber Resilience
Blog Post: Unlocking the Power of Risk-Based Vulnerability Management (RBVM)

Z

Zero Trust

Also known as perimeterless security, Zero Trust architecture emerged as an alternative to the perimeter-based security model, which was quickly rendered outdated as digital transformation and remote access were widely adopted across virtually all sectors. While Zero Trust originally pertained mainly to IT assets, the rapid digitization of operational technology (OT), medical devices, and other cyber-physical systems have made Zero Trust a fundamental best practice for securing the Extended Internet of Things (XIoT).

Related Resources

Blog Post: Essentials of Zero Trust Adoption & Secure Access
White Paper: Implementing Zero Trust for Industrial Environments
Blog Post: 5 Considerations to Implementing Zero-Trust in OT Environments

Zero Trust Network Access (ZTNA)

An access approach that enforces strict user and device authentication before granting access to applications or data, regardless of network location—aligning with the “never trust, always verify” principle

Related Resources

Blog Post: How ZTNA Strengthens Cyber-Physical Systems (CPS) Security

Zero-Day Attack

Zero-day is a flaw in software, hardware or firmware that is unknown to the party or parties responsible for patching or otherwise fixing the flaw. The term zero day may refer to the vulnerability itself, or an attack that has zero days between the time the vulnerability is discovered and the first attack.

Related Resources

Blog Post: ICS/SCADA Vulnerability Management: Proactive Strategies for Cyber Resilience
Blog Post: A Comprehensive Guide to Medical Device Vulnerability Management
Blog Post: Unlocking the Power of Risk-Based Vulnerability Management (RBVM)

Claroty Demo

Want to learn more about how the Claroty Platform can empower your CPS cybersecurity journey?

Get Breach Support Now

We’re here to help you secure your OT environment.

Get Breach Support Now

We’re here to help you secure your OT environment.