Successful implementation of cybersecurity into an operational technology (OT) environment demands recognition of its unique physical, cultural and organizational challenges. Only by acknowledging these can you craft a practical, effective approach that OT teams will buy into.

Overcoming these hurdles is especially crucial in the utilities and manufacturing sectors, where a cyber-attack-induced operational halt can affect critical national infrastructure and global supply chains.    

Based on our global experience introducing our cybersecurity expertise into OT environments, this article shares our recommendations for operations, IT and security professionals wanting a straightforward implementation process that meets OT defense requirements and makes sense to OT teams.  

Reducing cyber risk in OT with lessons from IT: Closing the vulnerability gap

Organizations with OT functions have often, over many years, developed organizational structures where IT and OT operate separately, creating silos of accountability.

A key reason for integrating IT and OT is the volume and richness of data within OT environments. This data fuels advanced analytics, leading to valuable insights and better business decisions. For example, digital twins and other technologies are enabling organizations to generate operational efficiencies and/or cost savings through predictive maintenance or other scenario-based strategies.

Aside from missing out on valuable business intelligence, the traditional siloed approach can also lead to gaps in overall cybersecurity, leaving business-critical OT infrastructure potentially vulnerable to cyber-attacks. It’s essential to recognize that such incidents are increasingly inevitable. A unified approach means consistent cybersecurity measures across both domains, protecting both OT critical infrastructure and IT business-critical infrastructure from cyber threats.

While it is important to protect both domains, IT has benefited from years of combatting cyber-attacks, consequently developing many effective techniques to mitigate the threat and impact of a malicious attack. Meanwhile, OT is working to close the gap with IT advancements, adapting IT principles to fit the unique requirements and perspectives of OT environments.

Securing your OT: Your first steps

There’s widespread agreement that robust defenses depend upon:

  • Discovering and mapping assets
  • Assessing their vulnerability to breach to understand where breach opportunities exist
  • Prioritizing remediation
  • Having a plan for when a critical incident occurs

Standards exist to guide the implementation of these security controls, such as NIST SP 800–82 R2 and IEC62443. These standards discuss the methods to secure an OT infrastructure environment and include:

  • Restricting logical access to the network and network activity through ‘demilitarized zones’ (DMZ) and firewall environments
  • Enforcing valid permissions and installing antivirus software
  • Developing the capability to restore systems should an incident occur

So, where do you start your implementation journey?

The journey to OT cybersecurity begins with a comprehensive understanding of your environment. Without this base knowledge, you can’t be entirely confident that any cybersecurity you apply will be sufficiently robust to protect your critical OT systems.

This process of discovery can be broken down into five stages: 

1. Discover what's "on" and connected to your networks 

This can be as simple as adding a sensor to listen passively to your environment. Activating passive listening means spanning the switch port on the local network, allowing the sensor to detect the different types of addresses coming across your environment and correlating the Media Access Control (MAC) IDs. 

Active discovery can be more effective in some cases but poses a potential risk where devices do not respond well to interrogation. The benefits of active scanning need to be compared to the risks in the development of an accurate asset inventory. The logistics of passive scanning across a large number of sites needs to be considered.

2. Conduct a physical walkthrough

Passive network scanning can provide a starting point, but it's crucial to complement this with a physical walkthrough to capture all your physical assets. You can only be confident you understand your environment by reconciling your digital and physical asset inventories and comparing them to what the sensor has discovered.

The challenging part of this process is learning how to compare what’s ‘on the wire’ versus ‘what’s on the floor’. Identifying network blind spots, this action will reveal:

  • Items on the floor that aren’t connected to any local network
  • Items on the floor that aren’t connected to a local network that you’re aware of
  • Networks and devices that existing sensors are monitoring
  • Networks that aren’t currently covered by sensors

3. Identify and categorize devices

This involves working through your discovered list to identify products that don’t necessarily have a reported MAC address. It also involves sorting all devices into categories, such as industrial devices, printers, access points, workstations and under-identified devices which need to be called out for further investigation. If you’re unlucky, you might find somebody has installed an unapproved device, such as a Raspberry Pi or a Wi-Fi extender/repeater. 

4. Assess internet connectivity

At this point, your monitoring device will start reporting potential security concerns, such as devices that can connect to the internet. It’s standard to find that many devices are connected to the internet without anyone realizing it. The next question is, do these devices need internet access, and if they do, how do you mitigate the risk without impacting production requirements?  

Another option is to perform an external scan of your environment to identify those devices that are seen by the Internet, and therefore by malicious actors. There’s little reason to expose industrial assets to the Internet, but if they are there then a bad actor can find them easily.

5. Help OT teams understand the importance of these findings

History has shown that these OT systems are frequently not as isolated as expected. For example, USB drives are plugged into systems, laptops connected to the IT systems are carried into the control rooms and plugged into the OT network, and undocumented networks are connected for convenience.

Showing the organization examples of other OT cyber-attacks such as the Stuxnet attack, the Sandworm attack targeting and disabling the Ukraine electrical infrastructure, the Oldmar’s treatment plant attack, and the ongoing attacks relating to the current Russian and Ukraine war is a good way of starting a conversation about your own vulnerabilities.

To close the IT/OT organizational gap, it’s important to acknowledge and address how different areas of expertise will work together and establish common terminologies between your OT and cyber engineers to make looking at the technology easier.

However, this isn’t the most significant factor in building OT defenses. A strong, trustworthy and mutually respectful relationship between OT and cyber experts is critical so that cybersecurity can be discussed in an open and appropriate manner.

The best way to build this relationship is to have continuous meetings, making sure that any OT cyber experts play a prominent role in sitting with OT teams and helping them take the cybersecurity journey.

Protecting your business through preparedness

Effective cybersecurity is a balancing act. Understanding your assets is key to defending those same assets, but you should consider the mantra of “assume breach.” Knowing how to react to a cyber incident is key to surviving in such a scenario, knowing who needs to be involved, knowing where your backups are, knowing your backups are secure, knowing how you should react--these are the ways in which you mitigate the impact of a cyber-attack.

Planning for the possibility of an incident, rather than assuming it won't happen to you, is the best way to ensure a swift and effective response.