--- title: "OT Cybersecurity at Fuel Terminals: IEC 62443 | Citia" description: "OT cybersecurity at a fuel terminal starts with assets, network separation, remote access and backups. See real risks and first steps under IEC 62443." url: https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals language: en updated: 2026-11-13 type: article site: Citia Engineering Indonesia --- # OT cybersecurity at fuel terminals: real risks and first steps under IEC 62443 OT cybersecurity at a terminal starts with knowing assets, separating networks, controlling remote access and testing backups. See real risks and ten first steps based on IEC 62443 and NIST SP 800-82. | Field | Value | | --- | --- | | Topic | Regulation and Integration | | Author | Tim Engineering Citia | | Updated | 2026-11-13 | Key takeaways OT cybersecurity at a fuel terminal starts with four steps: know every asset and its connections, separate the control network from the office network, control remote access, and confirm that backups can be restored. OT (operational technology) is the equipment and software that runs the physical terminal: PLCs, SCADA, the terminal automation system, gauges, meters and the networks between them. The ISA/IEC 62443 series is the common reference for securing it, and NIST SP 800-82 Rev. 3 gives practical guidance. This guide turns both into first steps a terminal can take without stopping operations, and points to the Indonesian rules for vital information infrastructure. - The first steps of OT cybersecurity at a terminal are to know every asset and connection, separate the control network from the office network, control remote access, and confirm that backups can be restored. - The ISA/IEC 62443 series is the common reference for securing industrial automation and control systems, and NIST SP 800-82 Rev. 3 gives practical guidance for operational technology. - Common real risks are vendor remote access, USB drives and laptops, default or shared passwords, servers without patches, a flat network and backups kept on the same network. - A SCADA system that is not connected to the internet is not automatically safe: removable media, laptops and maintenance connections reach it anyway. ## Why OT security differs from office IT security Office IT protects information. A terminal's OT protects a physical process that handles flammable product. NIST SP 800-82 Rev. 3 frames the task as securing OT while respecting its unique performance, reliability and safety requirements. In practice that changes the rules. A server in an office can be restarted tonight to apply a patch. A loading bay controller cannot be restarted while trucks are loading, and a patch for it may need vendor testing first. Equipment lives for many years, and some of it cannot run current software. Good OT security therefore uses compensating controls: separation, strict access, monitoring and backups that do not depend on touching the running system. - Main concern: Protecting information | Safe, continuous operation of the process - Restart for a patch: Usually possible tonight | Only in a planned window, often after vendor testing - Equipment life: Replaced on a short cycle | Many years, some past vendor support - Who touches it: Employees with managed laptops | Operators, vendors and contractors, often with their own laptops - Typical first control: Endpoint protection and patching | Network separation and access control ## Real risks at a fuel terminal Most incidents in control systems start with ordinary weaknesses, not exotic attacks. The table lists the weaknesses that appear again and again in terminal networks, with the first fix for each. None needs a large budget. All of them need someone to own the task and to check it later. - Vendor remote access: A permanent tunnel or shared remote tool left open | One controlled entry point, approval per session, session record - USB drives and laptops: A technician plugs a personal drive or laptop into the control network | Scan station for media, dedicated maintenance laptops - Default or shared passwords: The vendor password is never changed, and everyone uses one login | Named accounts, changed defaults, removal when people leave - Servers without patches: No one dares to restart the TAS or SCADA server | A patch plan with test copy, backup and a maintenance window - A flat network: Office PCs and PLCs share one network | Zones with a firewall between them - Backups on the same network: Ransomware reaches the backup together with the server | An offline or separate copy, restore-tested ## Know what you have: assets and connections You cannot protect a device you do not know is there. Start with a list: every PLC, server, HMI, switch, gateway, serial converter and remote link, with its model, version, location and owner. Then draw how they connect. The Citia article on PLC/SCADA assessment describes the same baseline: an asset register, the real topology and the backups, with uncertainty recorded as a finding when documents are incomplete. Small habits help. At LPG Panjang, labelling the wiring in the server rack in stages made cable paths easier to identify later, as the LTSA project record notes. The same labelling makes an unexpected cable easy to spot. Walk the site as well as reading the drawings. An undocumented second network card, a forgotten modem or a wireless access point added for convenience is exactly the connection an attacker finds first. Give the list an owner. OT security often falls between the IT team, who do not know the plant, and the operations team, who do not manage networks. A named person with authority over both, even part-time, keeps the inventory current and decides who may connect what. ## Zones and conduits: separating the networks Separation means a problem in one part of the network cannot freely spread to another. The IEC 62443 series describes this with zones and conduits. A zone groups assets that need the same level of protection. A conduit is a controlled communication path between zones, with a firewall or a similar control on it. At a terminal the natural zones are the field and control equipment, the TAS and SCADA servers, an interface zone for data going to the business systems, and the office network. The data link to SAP described in integrating TAS and TMS with SAP should pass through the interface zone, and the layers are explained in TAS architecture . Remote vendors enter through that same zone and never reach a PLC directly. - Field devices: Gauges, meters and valves. - PLC and RTU: Run the bays and the pumps. - TAS and SCADA: Servers and operator stations. - Interface zone: The only path to and from the business systems. - Office and SAP: Business systems and office PCs. - Remote access: Vendor sessions enter here, never at a PLC. ## How secure is secure enough Not every zone needs the same protection, and the standards give a way to decide. IEC 62443-3-3 describes security levels. A system has a capability level, which is what its design can withstand, and each zone gets a target level chosen from risk. The zone that runs loading control and pump interlocks deserves a higher target than the guest network in the visitor room, and the difference should show in the firewall rules, the account rules and the monitoring. The exercise also protects the budget. Raising every zone to the highest level is expensive and rarely needed, while leaving the control zone at the level of the office is how incidents start. ## Remote access, done safely Remote access is useful and dangerous in equal measure, so it needs rules. Vendors need to reach the system for support, and a night-time fault is a poor moment to argue about how. Decide in advance. Citia's technical bulletin on secure system integration describes a layered model with encryption, multi-factor authentication and a firewall, and the same layers apply to support sessions. After each session, close the temporary account, read the session record and file it with the fault report. A vendor who knows the record will be read is a more careful vendor. The contract side matters too. The LTSA guide lists the remote access, credential and incident terms to ask a service provider for. Do Avoid Ask which system and for how long: Before every remote session, ask the vendor which exact system they will touch and for how long, and write both in the session record. A session that grows beyond that answer is a reason to stop and ask again. - Use one controlled entry point for every remote session - Approve each session and set its time limit - Require multi-factor authentication and named accounts - Record the session and keep the record - A permanent tunnel to a PLC or an HMI - A shared password for the vendor team - Remote tools installed without the terminal's knowledge - Opening a PLC port to the internet for convenience ## Backups that survive ransomware A backup is useful only if it survives the incident and can be restored by someone who is tired and in a hurry. Keep at least one copy offline or on a separate system that ransomware on the control network cannot reach. Restore it on a spare machine at least once and write down what happened. The Citia reliability material makes the same point: a backup file alone does not establish recoverability, so record its version, date, source, target equipment and any licence or configuration dependencies. Citia's Condition Monitoring and Maintenance service includes backup and restore tests and network and gateway checks. Different layers need different backups: PLC programs, gateway configurations, databases, SCADA projects and engineering documents. The guide on PLC and SCADA backup and restore covers how to organise them. - Version: Which program or configuration version the file holds - Date and source: When it was taken and from which device - Target equipment: Which device it restores onto - Dependencies: Licences, passwords and settings needed to restore - Restore test: Date of the last successful restore and who did it ## Ten first steps A short checklist is better than a long policy that nobody starts. Work through these in order. The first four cost almost nothing and remove the largest risks. The rest build on them. Record the date and the owner of each step, because the record is what turns a good intention into a programme. - List every asset: PLCs, servers, HMIs, switches, gateways and remote links, with owners. - Draw the connections: Include serial, wireless and modem links that are easy to forget. - Change default passwords: Use named accounts and remove shared logins. - Close open remote paths: Replace permanent tunnels with one controlled entry point. - Separate the networks: Put a firewall between the office network and the control network. - Control removable media: A scan station and dedicated maintenance laptops. - Back up and test the restore: Keep one copy offline and restore it on a spare system. - Plan patches: Test on a copy, back up, then patch in a window. - Log and watch: Keep logs from firewalls and servers and review them. - Practise a response: Decide who is called, what is isolated and what evidence is kept. ## Watching and responding Prevention fails sometimes, so a terminal also needs to notice and to act. The Padalarang TAS support shows the habit: routine database backups and records of maintenance activity and configuration changes are kept as an audit trail. Keep logs from the firewall between the zones, from the servers and from the remote access point, and give someone the task of reading them on a schedule. Unusual hours, new devices on the control network and repeated failed logins are the first signs worth a call. Write a one-page response plan before it is needed: who is called, what is isolated first, how operations continue manually and what evidence is kept. Practise it once with operators, in the same spirit as testing a manual fallback for any other system. ## Where the standards and rules point Several documents can guide a terminal, and none of them has to be read cover to cover on day one. The ISA/IEC 62443 series covers the asset owner, the service provider and the system. IEC 62443-3-3:2013 maps the seven foundational requirements to system requirements and security levels. IEC 62443-2-4:2023 covers service providers. NIST SP 800-82 Rev. 3, published in September 2023, is a practical guide to OT security. In Indonesia, Peraturan Presiden Nomor 82 Tahun 2022 on the protection of vital information infrastructure names BSSN as coordinator, and energy and mineral resources is one of its sectors. Whether a given terminal is designated as vital infrastructure is decided under that regulation and BSSN's implementing rules, so ask your compliance team and check the current text on JDIH before assuming either way. - ISA/IEC 62443 series: The family of standards for securing industrial automation and control systems - IEC 62443-3-3:2013: System security requirements and security levels - IEC 62443-2-4:2023: Security program requirements for service providers - NIST SP 800-82 Rev. 3: Guide to operational technology security (September 2023) - Perpres 82/2022: Protection of vital information infrastructure in Indonesia, coordinated by BSSN ## Terms explained - OT: Operational technology: the equipment and software that run a physical process. - IACS: Industrial automation and control system, the term the IEC 62443 series uses for what runs a plant. - Zone: A group of assets that need the same level of protection. - Conduit: A controlled communication path between zones. - Interface zone (DMZ): A buffer network between the control network and the office network. - MFA: Multi-factor authentication: a password plus a second proof, such as a code. - Air gap: A network with no connection to others; in practice removable media and laptops still cross it. - Ransomware: Malicious software that locks data and demands payment, often reaching backups on the same network. ## Frequently asked questions Q: What is IEC 62443? A: IEC 62443 is a series of standards for the security of industrial automation and control systems. It covers asset owners, service providers and system design, with ideas such as zones, conduits and security levels. A terminal can use it as a checklist without seeking certification. Q: Is a SCADA system that is not connected to the internet safe? A: Not automatically. Removable media, maintenance laptops, vendor connections and undocumented links reach isolated systems all the time. Isolation helps, but it needs controls on media, laptops and every remaining connection. Q: How can a vendor access my system remotely and securely? A: Through one controlled entry point, with approval for each session, multi-factor authentication, named accounts, a time limit and a recording. The vendor should never have a permanent tunnel to a PLC or an HMI. Q: Where should OT security start at a terminal? A: With an asset list and a connection drawing, then default passwords, remote access, network separation and a restore-tested backup. These steps cost little and remove the largest risks first. Q: What is the difference between OT security and IT security? A: IT security mainly protects information, while OT security protects a physical process, where safety and availability come first. That is why OT relies on separation, strict access and monitoring when patching is hard. Q: Does a fuel terminal fall under Indonesia's vital information infrastructure rules? A: It depends on whether the operator or the system is designated under Perpres 82/2022 and BSSN's implementing rules, and energy and mineral resources is one of the named sectors. Ask your compliance team and check the current text before assuming either way. ## Sources and further reading 1. ISA/IEC 62443 Series of Standards, International Society of Automation (ISA) (https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards) 2. IEC 62443-3-3:2013 System security requirements and security levels, International Electrotechnical Commission (IEC), 2013 (https://webstore.iec.ch/en/publication/7033) 3. IEC 62443-2-4:2023 Security program requirements for IACS service providers, International Electrotechnical Commission (IEC), 2023 (https://webstore.iec.ch/en/publication/67631) 4. NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security, National Institute of Standards and Technology (NIST), 2023-09 (https://csrc.nist.gov/pubs/sp/800/82/r3/final) 5. Peraturan Presiden Nomor 82 Tahun 2022 tentang Pelindungan Infrastruktur Informasi Vital, Badan Pemeriksa Keuangan, Peraturan BPK, 2022 (https://peraturan.bpk.go.id/Details/211029/perpres-no-82-tahun-2022) 6. Secure system integration: API protocols for fuel terminal management, PT Citia Engineering Indonesia, 2025 (https://citia-engineering.com/en/news/secure-system-integration-advanced-protocols-for-fuel-terminal-management) 7. PLC/SCADA assessment: start with symptoms, topology and backups, PT Citia Engineering Indonesia, 2026 (https://citia-engineering.com/en/knowledge/reliability-plc-scada) 8. Cover photo by Raysonho @ Open Grid Scheduler / Grid Engine, CC0, Wikimedia Commons (https://commons.wikimedia.org/wiki/File:EthernetSwitch.jpg) Want a first look at your control network?: Send siTia, Citia's assistant on WhatsApp, a short description of your terminal systems and connections, and the engineering team will follow up. ## Contact - Company: PT Citia Engineering Indonesia - siTia - Virtual Assistance: [WhatsApp +62 813-2206-507](https://wa.me/628132206507). siTia answers questions about our products, projects and enquiries on WhatsApp. Replies are automated, and a person from the Citia team follows up. - Email: services@citiaengineering.com - Phone / WhatsApp (siTia): +62 813-2206-507 - Location: Bandung, Indonesia [Contact Citia](https://citia-engineering.com/en/contact.md) ## Structured data (JSON-LD) ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://citia-engineering.com/#organization", "name": "Citia Engineering Indonesia", "legalName": "PT Citia Engineering Indonesia", "alternateName": "Citia", "url": "https://citia-engineering.com", "logo": { "@type": "ImageObject", "url": "https://citia-engineering.com/media/citia-logo.png", "width": 950, "height": 328 }, "description": "Citia is an engineering and system integration company in Bandung, Indonesia. We connect field devices, PLC and SCADA, terminal software and enterprise systems, then install, test and maintain them.", "email": "services@citiaengineering.com", "telephone": "+62 813-2206-507", "address": { "@type": "PostalAddress", "addressLocality": "Bandung", "addressRegion": "Jawa Barat", "addressCountry": "ID" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "services@citiaengineering.com", "telephone": "+62 813-2206-507", "url": "https://citia-engineering.com/en/contact" }, { "@type": "ContactPoint", "contactType": "customer support", "name": "siTia - Virtual Assistance", "telephone": "+62 813-2206-507", "url": "https://wa.me/628132206507", "areaServed": "ID", "availableLanguage": [ "id", "en" ] } ], "areaServed": { "@type": "Country", "name": "Indonesia" }, "knowsAbout": [ "Terminal automation system", "Automatic tank gauging", "Tank management system", "SCADA", "Programmable logic controller", "Modbus", "Field instrumentation", "Weighbridge", "Pipeline pressure monitoring", "Industrial IoT" ], "brand": [ { "@type": "Brand", "name": "INTEGRA" }, { "@type": "Brand", "name": "CATALYST" } ], "sameAs": [ "https://www.facebook.com/citiaengineering/", "https://www.instagram.com/citiaengineering/" ] }, { "@type": "WebSite", "@id": "https://citia-engineering.com/#website", "url": "https://citia-engineering.com", "name": "Citia Engineering Indonesia", "inLanguage": [ "en", "id" ], "publisher": { "@id": "https://citia-engineering.com/#organization" }, "potentialAction": [ { "@type": "SearchAction", "name": "Search Citia News", "target": { "@type": "EntryPoint", "urlTemplate": "https://citia-engineering.com/en/news?q={search_term_string}" }, "query-input": "required name=search_term_string" }, { "@type": "SearchAction", "name": "Cari di News Citia", "target": { "@type": "EntryPoint", "urlTemplate": "https://citia-engineering.com/id/news?q={search_term_string}" }, "query-input": "required name=search_term_string" } ] }, { "@type": "WebPage", "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#webpage", "url": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals", "name": "OT cybersecurity at fuel terminals: real risks and first steps under IEC 62443", "description": "OT cybersecurity at a fuel terminal starts with assets, network separation, remote access and backups. See real risks and first steps under IEC 62443.", "inLanguage": "en", "isPartOf": { "@id": "https://citia-engineering.com/#website" }, "publisher": { "@id": "https://citia-engineering.com/#organization" }, "about": { "@id": "https://citia-engineering.com/#organization" }, "breadcrumb": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#breadcrumb" }, "dateModified": "2026-11-13", "mainEntity": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#entity" } }, { "@type": "BreadcrumbList", "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Citia", "item": "https://citia-engineering.com/en" }, { "@type": "ListItem", "position": 2, "name": "Knowledge", "item": "https://citia-engineering.com/en/knowledge" }, { "@type": "ListItem", "position": 3, "name": "OT cybersecurity at fuel terminals: real risks and first steps under IEC 62443", "item": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals" } ] }, { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#entity", "url": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals", "mainEntityOfPage": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#webpage" }, "@type": "TechArticle", "headline": "OT cybersecurity at fuel terminals: real risks and first steps under IEC 62443", "description": "OT cybersecurity at a terminal starts with knowing assets, separating networks, controlling remote access and testing backups. See real risks and ten first steps based on IEC 62443 and NIST SP 800-82.", "dateModified": "2026-11-13", "author": { "@id": "https://citia-engineering.com/#organization" }, "publisher": { "@id": "https://citia-engineering.com/#organization" }, "inLanguage": "en", "articleSection": "Regulation and Integration", "datePublished": "2026-11-13", "image": "https://citia-engineering.com/media/covers/ot-cybersecurity-terminals.webp" }, { "@type": "FAQPage", "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#faq", "url": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals", "inLanguage": "en", "isPartOf": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#webpage" }, "mainEntity": [ { "@type": "Question", "name": "What is IEC 62443?", "acceptedAnswer": { "@type": "Answer", "text": "IEC 62443 is a series of standards for the security of industrial automation and control systems. It covers asset owners, service providers and system design, with ideas such as zones, conduits and security levels. A terminal can use it as a checklist without seeking certification." } }, { "@type": "Question", "name": "Is a SCADA system that is not connected to the internet safe?", "acceptedAnswer": { "@type": "Answer", "text": "Not automatically. Removable media, maintenance laptops, vendor connections and undocumented links reach isolated systems all the time. Isolation helps, but it needs controls on media, laptops and every remaining connection." } }, { "@type": "Question", "name": "How can a vendor access my system remotely and securely?", "acceptedAnswer": { "@type": "Answer", "text": "Through one controlled entry point, with approval for each session, multi-factor authentication, named accounts, a time limit and a recording. The vendor should never have a permanent tunnel to a PLC or an HMI." } }, { "@type": "Question", "name": "Where should OT security start at a terminal?", "acceptedAnswer": { "@type": "Answer", "text": "With an asset list and a connection drawing, then default passwords, remote access, network separation and a restore-tested backup. These steps cost little and remove the largest risks first." } }, { "@type": "Question", "name": "What is the difference between OT security and IT security?", "acceptedAnswer": { "@type": "Answer", "text": "IT security mainly protects information, while OT security protects a physical process, where safety and availability come first. That is why OT relies on separation, strict access and monitoring when patching is hard." } }, { "@type": "Question", "name": "Does a fuel terminal fall under Indonesia's vital information infrastructure rules?", "acceptedAnswer": { "@type": "Answer", "text": "It depends on whether the operator or the system is designated under Perpres 82/2022 and BSSN's implementing rules, and energy and mineral resources is one of the named sectors. Ask your compliance team and check the current text before assuming either way." } } ] }, { "@type": "DefinedTermSet", "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#glossary", "url": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals", "inLanguage": "en", "isPartOf": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#webpage" }, "name": "Terms explained", "hasDefinedTerm": [ { "@type": "DefinedTerm", "name": "OT", "description": "Operational technology: the equipment and software that run a physical process.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#glossary" } }, { "@type": "DefinedTerm", "name": "IACS", "description": "Industrial automation and control system, the term the IEC 62443 series uses for what runs a plant.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#glossary" } }, { "@type": "DefinedTerm", "name": "Zone", "description": "A group of assets that need the same level of protection.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#glossary" } }, { "@type": "DefinedTerm", "name": "Conduit", "description": "A controlled communication path between zones.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#glossary" } }, { "@type": "DefinedTerm", "name": "Interface zone (DMZ)", "description": "A buffer network between the control network and the office network.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#glossary" } }, { "@type": "DefinedTerm", "name": "MFA", "description": "Multi-factor authentication: a password plus a second proof, such as a code.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#glossary" } }, { "@type": "DefinedTerm", "name": "Air gap", "description": "A network with no connection to others; in practice removable media and laptops still cross it.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#glossary" } }, { "@type": "DefinedTerm", "name": "Ransomware", "description": "Malicious software that locks data and demands payment, often reaching backups on the same network.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/ot-cybersecurity-terminals#glossary" } } ] } ] } ```