As digital transformation and OT/IT convergence accelerate, attacks against critical infrastructure and other OT systems are on the rise. Water treatment plants, energy providers, factories, chemical plants, the infrastructure that supports our daily lives can all be at risk. Disruption or manipulation of OT systems can cause real physical harm to people, the environment and the economy.
However, the landscape of OT security tools is far less developed than that of information technology (IT) security tools. According to recent information, Reports from Takepoint Research and CyoloThere is a significant lack of trust in tools commonly used to secure remote access to industrial environments.
 |
| Figure 1: New research reveals a wide industry-wide gap between levels of concern about security risks and levels of trust in existing solutions for industrial secure remote access (I-SRA) I was. |
The traditional security strategy for industrial environments has been isolation, isolation from the Internet as well as other internal systems. But now, with OT systems opening up to the world and cyberthreats proliferating, the shortage of OT-specific security tools has emerged as a pressing problem. In this void, IT solutions are often jumbled to meet the needs of OT, but as you can imagine, the results are usually lackluster.
Security solutions designed for IT environments cannot meet the demands of OT and industrial realities for several main reasons.
Reason 1: OT prioritizes availability over confidentiality
Both IT and OT ensure confidentiality (protection of sensitive data and assets), integrity (data fidelity over its lifecycle), and availability (accessibility and responsiveness of resources and infrastructure) , but prioritize different parts of this CIA. triad.
- IT’s top priority is confidentiality. IT deals with data. IT stakeholders are concerned with protecting their data, from trade secrets to the personal information of their users and customers.
- OT’s top priority is availability. OT processes operate heavy-duty equipment in the physical realm. For OT processes, availability means safety. Downtime is intolerable when shutting down blast furnaces and industrial boiler tanks.
To ensure availability and responsiveness, most OT components were completely unbuilt for security implementations.
This is a fundamental difference in the very DNA of IT and OT environments that immediately makes implementing IT security tools difficult.
Reason 2: OT systems run on always-on legacy systems
While it may be difficult for those living in IT to imagine Windows XP and 80’s mainframes still running today, that’s the stark reality of the OT world. Whether it’s for profit or safety, your OT system is always running at full capacity. This is why OT components are designed for much longer lifecycles.
Nearly all IT-based tools require downtime for installation, updates, and patching. No matter how severe the vulnerability, these activities are usually not the beginning for industrial environments. Again, downtime for OT systems means compromising safety.
Additionally, the legacy systems that power the OT world are typically unable to communicate with modern security and authentication tools, limiting the effectiveness of these platforms from the start. Without a security solution like Cyolo, Refurbish legacy applications Supporting modern security protocols severely limits the ability of IT tools to protect OT systems.
Reason 3: IT tools almost always need connectivity
External connectivity is usually required in IT security solutions because servers and applications need to exchange data with each other (and users) to perform critical functions. In contrast, OT systems often have specific requirements on when and how they can connect to the internet (yes, even in the age of digital transformation). IT tools cannot always be configured to meet these requirements.
The nuance is that IT and OT systems can connect to each other without forming a permanent connection. In this way, OT environments can be positioned to achieve the benefits of automation, production data, and other digital transformation efforts without creating unnecessary access points for malicious actors.
Reason 4: OT systems are highly volatile
While the IT world has standardized around the TCP/IP protocol, there is no such consensus in the OT world. OT systems use a variety of communication protocols, which are often determined by the original equipment manufacturer.
For example, if an OT operator purchases Programmable Logic Controllers (PLCs) from several different providers, each provider may take a different approach to meeting the IEC-61131 standard. Therefore, OT engineers have to learn and maintain as many types of software and protocols as there are vendors.
Even within OT, protocols are often incompatible with each other. absolutely Incompatible with common protocols used by IT-based security tools. I doubt that IT tools can cover the full range of his OT use cases for a given environment.
Reason 5: OT systems are delicate
Due to their mutable and always-on nature, OT systems are easily disrupted by even the most basic IT processes and security best practices.
- Passive scanning can also take vulnerable OT systems offline, reducing security coverage to below acceptable levels by the time scanning is curtailed and restricted to offline systems.
- Logon banners that run on endpoints typically interrupt the auto-login process of critical OT systems.
Because visibility is difficult to achieve in OT environments, it can be difficult to predict the consequences of introducing new tools. For this reason, OT systems typically require more extensive testing and validation before implementing new tools.
OT environments need OT solutions
It’s often said that strategy precedes tools, and it’s true. IT and security teams working in the OT space should take the time to understand and embrace the OT philosophy and needs, and work with OT stakeholders to define best practices.
Having said that, the right tools still matter a lot. The cybersecurity market is noisy and can be misleading. IT and OT stakeholders should ask the right questions before committing to a particular tool or vendor.
The world of OT deserves to benefit from modern security controls without compromising the safety of workers, operations and bystanders. The right solution not only strengthens your security posture against tomorrow’s attacks, but also positions security to contribute to innovation rather than hinder it.
Want to learn more about the key challenges facing OT security professionals today? read the full report From Takepoint Research and Cyolo.
