OT

A medieval city was never secured by its wall alone. It had guilds that vouched for their members, letters of introduction carried from town to town, gate guards who knew faces, innkeepers who noticed accents, and neighbours who registered a stranger in the lane before any official did. The wall was one instrument among many, and arguably not the most effective one. What kept the city safe was a dense weave of overlapping trust relationships, most of them informal, all of them cheap (in financial terms). ...

There’s a fundamental problem with learning operational technology security: the things you need to test are the things you absolutely must not break. This creates what educational theorists call “a bit of a pickle” and what facility operators call “no, you’re definitely not touching the production turbines with your laptop.” It’s rather like learning to defuse bombs. The theory is straightforward, the practise is somewhat more stressful, and mistakes tend to be memorable for everyone in the vicinity. In OT security, mistakes might not result in explosions (usually), but they can shut down production, trigger safety systems, or cause equipment damage. These outcomes are suboptimal for learning environments and remarkably unpopular with operations teams who prefer their turbines spinning at correct speeds rather than serving as expensive educational exhibits. ...