Gartner defines operational technology (OT) is hardware and software that detects or causes a change, through the direct monitoring and/or control of industrial equipment, assets, processes and events.
The analyst predicts that by 2023, 60% of today’s point solution IT security providers will have rebranded, repositioned or bought, or will have disappeared.
For decades OT has been largely ignored by IT because OT it is considered the responsibility of operations, and has little to do with IT. Over the years OT has caught up in terms of sophistication and value to the business. While IT has long been recognized as a cost centre, OT continues to deliver value because it is the technology that is the interface between consumers and businesses.
It is this value that has made OT the new target for cybercriminals.
FutureIoT spoke to Galina Antova, co-founder and chief business development officer at Claroty, a provider of industrial cybersecurity.
Briefly describe what operational technology (OT) looks like in a typical enterprise.
Galina Antova: Industrial control system networks, or what is also known as OT, can be found in everything from manufacturing plants to energy production and distribution, and even ventilation and building management systems.
While OT is most commonly related to industries such as oil and gas, utilities and manufacturing, digital initiatives as part of Industry 4.0 have brought about new applications of OT, such the use of sensor devices for smart cities and smart buildings to control energy usage remotely, and gather aggregated data for analytics.
Since OT networks relate to physical processes at a macro scale, security issues for OT are possibly more tangible than that for IT, as they include the potential disruption of essential services that drive the global economy and support everyday life – think our power supply, street lighting systems, and so on.
Who owns responsibility for OT within a typical enterprise?
Galina Antova: CIOs, who set the strategy for their companies to use technology to achieve their organisational or business objectives, are increasingly taking ownership of OT in addition to IT. They work together with CISOs to protect their enterprise’s data and operations, as a matter of critical importance.
But the expertise and experience that CIOs and CISOs have typically lie in IT, and a common misconception is that they can simply use IT security tools to protect their OT.
In fact, most traditional IT security tools are completely incompatible with OT networks. A key reason for this is that unlike the standardized protocols utilized by IT networks, OT networks usually use proprietary protocols, which are largely unrecognizable by IT security tools.
Can you describe efforts to integrate OT with information technology (IT)? Where are gaping holes in the integration process?
Galina Antova: Today, OT such as Programmable Logic Controllers (PLCs), which are basically real-time computers optimized for industrial environments, are highly networked to optimize efficiencies and facilitate data sharing enterprises and with third parties.
Indeed, the Internet of Things (IoT) has penetrated the industrial ecosystem across all sectors. Demand for real-time analytics to ensure uptime and enable better decision-making has ushered in a whole new reality for manufacturing companies and critical infrastructure operators, where IT, OT, and IoT devices are converging to form a highly interoperable ecosystem, where the shop floor is connected to the back office, which is connected to the cloud.
This integration process is not seamless of course. One of the biggest gaps is that OT has different performance and reliability requirements compared to IT and, they also use operating systems and applications that may be considered unconventional in a typical IT network environment.
Traditionally, an air gap approach has been used to secure OT environments, completely isolating two domains. This air gap technique is still used in environments that need the highest degree of security, such as in military, intelligence organizations, and the energy sector.
But this approach is counter to the convergence of IT and OT, where IT systems increasingly “consume” data from OT systems, and where OT system vendors need to remotely monitor their equipment.
How does COVID-19 influence (or not) the importance of OT in business continuance?
Galina Antova: The biggest change in business continuance is the sudden shift to a largely remote workforce. Although businesses can still be productive with video conferencing and other productivity tools, there are unique implications for a largely remote workforce when it comes to securing an operational technology (OT) network.
Operational technology engineers, the people who work in plants and factories are now, more often than not, not on site, but they still need to perform certain activities, whether they are around controlling the actual devices themselves, providing maintenance, or analytics.
This presents a challenge for organizations, and indeed we are seeing a growing threat against industrial organizations that rely heavily on remote access, especially in this COVID-19 situation, to maintain their operations.
Financially-motivated hackers are taking notice and engaging in targeted spear-phishing campaigns to compromise the accounts of those with privileged access for the purposes of stealing data or extorting operations with ransomware.
Security teams that are responsible for provisioning and monitoring access to those systems need to make sure there is an identity management solution in place so they know exactly who is on the other end.
They need to be able to monitor those sessions in real-time and if necessary, terminate them. With adequate OT security measures in place, businesses can continue to operate while keeping employees safe.
In 2020, what remains as top 3 key challenges for OT? Who should own this responsibility?
Galina Antova: At the top would be securing OT for remote access in this new normal. Any employee or third-party contractor who previously worked onsite, but now works outside the facility, requires online access to ensure uninterrupted operations.
Monitoring and making changes to production lines and manufacturing processes can become even more mission-critical during times of disruption, depending on the industry and products and services provided. Because OT network traffic provides all the security information needed to monitor for threats.
Next, a key challenge is to get the buy-in from the CXO level to prioritize OT security at the same level as their IT security. They need to understand the unique characteristics and security needs of OT and provide proper security controls.
Another challenge is securing OT with zero downtime to operations. As OT deals with physical processes and operations, there is a significant risk at hand. This includes the health and safety of human lives, serious damage to the environment, and financial issues such as production losses, and a negative impact on a nation’s economy.
Security protections must be implemented in a way that maintains system integrity during normal operations as well as during times of cyberattack.
Your expectations around the development (do we even include convergence) of OT vis-a-vis IT?
Galina Antova: The convergence of IT and OT networks is creating greater urgency to bridge the IT/OT security gap. While convergence unlocks business value in terms of operations efficiency, performance, and quality of services, it can also be detrimental because threats that target OT environments now have a pathway into IT environments and vice versa.
Creating additional challenges, in many industries IT compliance requirements are now being applied to converged IT/OT environments. On top of this, adversaries are using the prevalence, security gap, and convergence of these networks to advance geopolitical agendas and cause disruption.
But it doesn’t have to be this way. By protecting OT environments, CIOs and CISOs can extend their role as business enablers – a reputation they’ve earned building a strong cybersecurity foundation on the IT side to support digital initiatives. I believe 2020 provides them with an incredible opportunity to be agents for change.
