Packet-Layer Capability Triad for Remote OT

Remote operational technology sites, such as water and wastewater pump and lift stations, roadside traffic-control cabinets, distribution substations and oil-and-gas RTU locations, often combine legacy endpoints, remote administration, sparse staffing and insufficiently segmented field networks. Standards and government guidance prioritize reducing exposure, segmenting networks and replacing or hardening insecure equipment, but cost, outage and workforce constraints can delay those controls. This paper asks a narrower question: which packet-layer capabilities could reduce cyber-physical risk while those preferred controls remain incomplete?

It is a conceptual synthesis, not an experimental validation or a systematic review. Using a purposively selected set of primary-source incidents, it identifies three recurring attack stages: discovery or remote access, traversal of weak boundaries, and manipulation through authorized interfaces or well-formed control actions. It then defines a candidate triad of capabilities that operate on the network path without software agents on protected controllers: automated moving target defense with embedded deception, cyber-physical anomaly enforcement based on communication and process state, and command-aware industrial-protocol enforcement.

The paper maps the triad to the attack path, relates it to NIST cyber-resiliency guidance and IEC 62443 compensating-measure concepts, and specifies a falsifiable evaluation program. It states its limits plainly: the triad is not equivalent to zones-and-conduits segmentation, and it does not address direct physical bypass, encrypted traffic or authorized-but-malicious command paths. Colonial Pipeline is treated as a boundary case, because public reporting found no lateral movement into operational technology.