OT-IT convergence brings opportunities and risk

Operational technology (OT) or industrial control systems (ICS) are responsible for keeping the power on and water and gas flowing to support essential services for consumers, industry and governments. As technology advances, utilities are introducing Internet connections (IT) to their OT networks to improve operational efficiency. They are also linking their OT systems to their IT systems to leverage the rich data being collected.

This OT-IT convergence is proving to boost performance and streamline ways of working by enabling capabilities such as off-site monitoring and remote maintenance. However, when it comes to cybersecurity, the majority of OT systems were developed in the 80’s and 90’s with little idea they would be part of a connected society, and thus with little thought to security.

Because a cyber threat to IT is now becoming a cyber threat to OT as well, and vice versa, there’s no question that utilities must look at cybersecurity holistically across the two domains. But there are huge differences in how they operate―from cultures, to chains of command, to drivers, focus areas and job descriptions.

In the OT environment, the focus is on high availability, and safety is paramount. Here, the impact of a cyber breach can include outages, physical injury and even loss of life. In the IT environment, which often supports back-office functions, operations are more controlled and managed. The impact of an IT breach tends to be financial or reputation loss, which can be very significant.

A recent study by CGI in the UK, The Cyber-Value Connection has found that a severe cybersecurity breach represents a permanent cost of 1.8% of company value, as measured relative to a control group of peer companies. It may be logical to assume that an OT breach causing a widespread service outage and/or physical harm could have an even greater impact on valuation.

The differences in OT and IT must be recognized to develop sound cybersecurity strategies in a connected world. Attempting to migrate security processes and tools from one side to the other is not a viable approach.

But how can utilities (or other ICS industries like oil and gas or transportation) bring both sides together to ensure a common path to cyber vigilance?

The high level of preparedness required to mitigate both OT and IT threats requires a holistic approach across the dimensions of people, process, technology and governance.

Given the vast differences between OT and IT, utilities may need the expertise of strategic partners who understand both domains to help bridge the divide. The goal is an end-to-end cyber program that starts from the most basic levels (plant floor and field device) and moves up the organization through to the board room. (Read more on improving cyber governance in my colleague Andrew Rogoyski’s blog.)

The following are recommended steps for developing a cybersecurity approach to support OT-IT convergence to achieve greater situational awareness and enterprise-wise visibility into threats and preparedness.

While OT and IT may be drastically different technology environments, the utilities industry is looking to combine these worlds, which means that vulnerability for attacks is higher, and protection is a first and foremost priority.

CGI works with utilities and other ICS industries to understand and assess the criticality of their OT-IT security environments, identify gaps, determine where best to make investments, and assist with planning, implementation and operations.

Learn more about this topic in our white paper, Convergence Brings Opportunities and Risk.