arrow - Fotolia
The security challenges of OT and how the IT department can help
Operational technology comes with its own unique challenges and benefits, but the IT department can shine a light on how to tackle its security issues
Operational technology (OT) is so called because it uses hardware or software to carry out processes that align with the aims and processes of a specific department in the enterprise. This can make knowing whose responsibility it is to secure that technology difficult.
Added to this is the problem of having sensors connected to one network but scattered all over the world, as is the case with some operational technology. This can be tricky to keep tabs on and, therefore, difficult to secure, making OT networks an increasingly attractive target for hackers.
To secure OT effectively, the IT department needs to be involved throughout the entire implementation process, rather than just retrospectively after a cyber attack occurs. The current problem is that the department set to benefit the most from the implementation of the new technology often focuses solely on the deployment to see results faster. However, this is when oversights occur and vulnerabilities materialise.
For organisations to start understanding the problem with OT security, they will need to begin with looking closely at their network and involving IT in the conversation.
OT threats are on the rise
It’s no secret that OT threats are on the up. According to Skybix Security’s latest Vulnerability and threat trends report, there is an increased risk to the growing attack surface, brought about by the likes of the industrial internet of things (IIoT) and OT networks.
Attacks on OT continue to climb, with a 10% increase between 2017 and 2018. While the attacks range in motive and impact, the WannaCry outbreak that hit Taiwanese Semiconductor Manufacturing Company (TSMC) was a prime example of how a cyber criminal tool such as ransomware, nation-state threats and internal exposure can create the perfect cyber attack storm: wreaking havoc on a network and a company’s bottom line. Stuxnet also caused similar damage in 2010.
Just as with the internet of things (IoT), operational technology is a target because it is so widely used and, as with IoT devices, OT devices are yet another endpoint hackers can use to gain access to an otherwise secure – and often valuable – network.
Keeping the IT departments in the loop
The typical traffic produced by OT sensors and controlling devices simply cannot be managed by traditional security components such as firewalls. This makes the role of the IT department especially vital in remaining secure.
While the responsibility for OT devices currently falls with the industrial production and resources department, it should fall with the IT team given that these devices are connected to the internet.
As connectivity in the IIoT continues to accelerate, efforts to secure industrial control systems (ICS) struggle to keep pace. Despite these growing security concerns, traditionally air-gapped OT is increasingly being tasked with using internet-connected devices to improve operational processes, reduce costs and minimise downtime. Until security becomes a priority, industrial organisations will remain soft targets for threat actors.
OT solutions increasingly rely on IT infrastructure and services, which increases the overlap of skills for managing the two and further justifying the need for greater IT involvement.
From the outset, employees should be educated on security best practices just as with any digital transformation project – everything from regularly changing passwords, to being able to spot a phishing email.
Securing multiple points of vulnerability has always been a major challenge for businesses and – whether it’s a company laptop, a phone, or a smart temperature gauge in a fish tank in an individual’s home – the solution to securing different devices is never one-size-fits-all.
When it comes to securing OT, best practice policies are very similar to those implemented on any other technology. Just last year, the state of California passed a law setting higher security standards for net-connected devices making default password such as “admin” and “password” illegal to use. This same precedent should be applied throughout the implementation roll-out of any operational technologies.
In the future, we can expect more devices to become connected to the internet and, with that, IT teams will increasingly apply machine learning and artificial intelligence to keep them secure. IT teams will, therefore, need to be informed of any implementation of OT, and any other employees who share the responsibility of OT must be educated on basic security protocol.
As the roll-out of OT continues to gather pace, the channel must do all that it can when it comes to helping to educate its customers and partners in this way – educating every employee and department from the ground up on staying OT secure.
Read more about operational technology
- Building IoT connectivity with a PI Server across multiple plants to improve analytics and efficiency is a great goal, but achieving it isn’t without its challenges.
- While there hasn't been any horizontal IoT use cases in EUC, IoT is alive and well in enterprise operational technology departments, and VMware thinks they’ll lean more on IT as time goes by.