IT (information technology) and OT (operational technology) teams have historically and traditionally been separated over the years – and for good reason. Their priorities are different. Their approaches and processes are different. They are truly different worlds of digital and physical results. However, the worlds are colliding from strategic initiatives related to Industry 4.0 or digital transformation. This gives even more impetus to discover what they can learn from one another.
What’s different between the disciplines of IT and OT? One key difference is that OT deals with physical outcome-producing assets. OT is everything IT is, plus physics (IT + physics = OT).
A digital safety framework for OT
Given the differences between the disciplines, what can OT learn from IT? IT does not relinquish or delegate their roles and responsibilities to other business units. They take responsibility for business systems, infrastructure, applications and data technologies under their charge. Taking full responsibility and ownership of the assets under their charge is one big step OT must take.
OT needs to develop an National Institute of Standards and Technology (NIST) framework (identify, protect, detect, respond and recover) or MITRE ATT&CK or something similar. They need to assign team members who have the authority, responsibility and ownership for cybersecurity within the their organization. They should be tasked with implementing and managing cybersecurity efforts and measures related to industrial control systems (ICS) devices.
When it comes to IT, there is no question who owns IT technologies. Those in the OT organization have to overcome the belief that they are not responsible for cybersecurity as it relates to their ICS. OT not taking responsibility is the equivalent of them stating they are not responsible for safety, which is everyone’s responsibility and the number one priority with ICS.
When working with OT practitioners, cybersecurity experts must frame the discussion around digital safety, a term that encompasses both physical production and kinetic devices controlled by digital systems (IT + physics = OT). The plausible deniability position taken by OT and IT that we commonly see demonstrates confusion around ownership of associated risk. This opens them up to vulnerabilities in their environment where catastrophic events can happen. A clear owner needs to be defined and agreed upon.
Common business rules of demarcation
The cybersecurity ownership mentality of IT needs to be embraced within OT. Clear lines of demarcation need to be established and understood between OT and IT. Many would say that by installing a firewall or implementing an industrial demilitarized zone (IDMZ ), those boundaries exist. If that was true for every security measure put in place by IT, then OT would replicate. For example, if IT installed a firewall to segment between IT and OT networks; what are the prescribed techniques, tactics and procedures (TTP’s) for engagement between OT and IT networks? If IT deploys a firewall, then OT should also deploy a firewall under their charge. Why would OT assume IT is protecting them? How would IT even know what is considered valid traffic in an ICS environment?
Take IT and OT out of the mix. If a business wants to connect to the internet or some other network, they deploy a firewall and DMZ on both sides. There is zero trust between the outside world and the internal network because of the unknowns. IT can control only what they have responsibility for, so they would deploy a firewall facing foreign networks.
Even within the same organization, IT and OT are basically third parties to each other with completely different roles, responsibilities, applications, systems and technologies. Why would OT blindly trust IT? By installing the firewall, IT is basically saying they do not trust OT. Does IT put firewalls between accounting and sales? Most likely not. Then why implement a firewall between IT and OT? OT is foolish to think IT is protecting them by installing a firewall for only IT’s benefit. OT should take the same position as IT with other third parties, by installing and managing their own firewalls.
Ownership of digital safety and cybersecurity for ICS
Haphazardly or unwittingly, IT is led to believe they are the defenders of ICS until someone shows them the actual ICS in question. Once the ICS devices are finally brought into the light, IT will very quickly respond that those ICS technologies on the plant floor are not in their scope. If not IT, then who is responsible for ICS cybersecurity?
IT without question or hesitation would say they are responsible for the system application and product in processing (SAP), email, data centers and business networks. If IT does not see ICS equipment as in their scope, and OT has not or does not seem to be stepping up to take ownership of their environment from a cybersecurity perspective, where does that leave things?
Asset visibility and network monitoring
Visibility has been important for both groups to see what devices exist on their networks. Most IT groups today have tools that automatically discover those devices that live on their network. With these asset inventory and configuration management tools, they can get up-to-date information on what is connected to their environment, the software levels, installed programs, patch levels and so on. More and more IT departments today have some level of network monitoring in place. This allows the IT side to manage those assets in larger groups for necessary updates and upgrades. OT needs to take the same steps with asset detection, monitoring and remediation.
Investment management
A key differentiator between IT and OT is the total cost of ownership (TCO) model and how investment is viewed across both disciplines. IT is typically viewed as overhead or expense versus OT, which is embedded in the revenue-generating side of the business. OT capital expenditures (CapEx) spending is viewed and treated differently in relation to ICS assets, compared to IT investments. The life cycles for technology are also much different. The OT asset life cycle replacement is measured in decades, while the IT technology asset life cycle is less than a decade, averaging between three and seven years.
IT leverages orchestration platforms to assist in managing a wide range of IT-centric technologies. This simplifies the management, administration and support functions into standardized toolsets to assist with outsourced strategies to third parties, which in turn helps reduce TCO. Whether a security information and event management (SIEM), security orchestration, automation and response (SOAR), or manage detection and response (MDR), these allow rollups of the massive amount of data the IT network produces so teams can sort through and identify incidents that require verifying and validation of events.
Leveraging third-party suppliers and vendors
OT and IT both leverage their supply chain of technology partners and third-party professional services. The challenge is these supply chains have different go-to-market strategies, initiatives, skills and expertise. For example, you can find an IT technology company such as Cisco that sells both enterprise and industrial technologies into both IT and OT environments. However, how the technology gets there is via two different paths. IT buys for the enterprise, and OT buys for the industrial side of the business.
Cisco’s large value added resellers (VAR) believe they can operate in OT environments as actual practitioners, yet OT organizations never engage IT VARs on any ICS-specific projects requiring IT technologies. IT will buy and hire from the IT VAR supply chain, but they can never get where they need to be to provide best-in-class cybersecurity or process integrity solutions for ICS. On the other hand, OT has supply chain automation technology suppliers such as Rockwell, Siemens or Schneider Electric, who can provide best-in-class solutions and operate in the OT environments from a cybersecurity perspective.
The first challenge for these firms is that they cannot scale to handle the sheer volume of OT environments in the market. Second, industrial manufacturers have a variety of technologies deployed. No industrial manufacturer has 100% of one specific automation vendor’s technology deployed within one site, let alone across their entire fleet of plants.
The OT supply chain is also not trying to be something it is not, meaning it is not trying to sell into IT. Automation technology vendors and their supply chain (system integrators, OEMs) are not trying to sell enterprise class systems, infrastructure, applications or networks into IT organizations. They tend to stay in their own lanes but will be the first to admit they are pursuing cybersecurity initiatives with OT clients with little to no success without OT buy in.
Adhering to the “when, not if” principle, cybersecurity has been on the minds of IT staff for years and many have an established, and likely growing, security processes. Whether following a specific framework such as NIST, MITRE or an internal process, they have established procedures and risk management that have been maturing over the years on identification, protection, detection, response and recovery.
Ownership and role definition
The final areas of learning that OT can take from IT falls under ownership, roles and resources. The first area involves defining the ownership and roles involved. With the above-mentioned tools and processes, IT is more clear around who owns and is responsible for the actions to support digital safety and cybersecurity within their environment. It may be divided up by organizations, teams or business units.
A final key learning that OT can take from their IT counterparts is the understanding that when it comes to resources, IT doesn’t go it alone. Most IT teams make use of expert resources and services through their ecosystem of partners and vendors. IT vendors come in all shapes and sizes — application, hardware, cloud, managed service providers and consultants. IT doesn’t have enough resources or bandwidth to address the demand, so leaning on outside vendor partners is a proven method to get things done.
OT faces the same internal resource constraints. By learning and replicating the relevant processes and approaches to resources, funding, role definition and oversight that IT has successfully put in place over time, OT will be in a greater place of strength to monitor and manage their way through these turbulent times, which require the utmost diligence with digital safety and cybersecurity measures for both industrial manufacturing and critical infrastructure environments.
Connecting IT and OT strategies will only make their defenses more efficient and stronger.
Do you have experience and expertise with the topics mentioned in this article? You should consider contributing content to our CFE Media editorial team and getting the recognition you and your company deserve. Click here to start this process.
