Sorting a dairy's systems — the plant controller, the ERP, the milking robot, the web shop, the warehouse sensors — into IT, OT, IoT and cloud: which goes where, and what does the exercise reveal?

Roughly: office and business applications are IT, the plant control and milking robots are OT, the sensors and animal trackers are IoT, and the web shop and supplier portals are typically cloud — and the revealing part is that a single company holds all four at once.

* One company, all four kinds of cyber system — and no single policy can govern them. *

Three lessons come out of the sort, and they are the reason the classification is worth doing:

1. One company, all four categories. There is no such thing as "we're an IT shop" or "we're an OT shop" at this scale — which is why an architecture that only masters one category leaves the other three unmanaged.
2. The categories demand different security. The ERP can be patched on Tuesday; the plant controller may have a maintenance window once a year and a vendor warranty that forbids changes. The same policy cannot govern both.
3. The assignment is not always clean, and that is informative. A cloud-hosted ERP is IT and cloud; a cold-chain sensor whose data feeds production control is IoT sitting on an OT process. The borderline cases are where responsibility usually falls between two teams — which is exactly where incidents start.

Go deeper:

• Wikipedia — Mirai (malware) — what the IoT column costs when nobody treats it as a category: default credentials at internet scale.