Operational technology: The new cybersecurity battleground

by Eddie Stefanescu, GM - Asia Pacific & Japan, Claroty

As the world scrambled to adapt to the COVID-19 pandemic, enterprises have had to fast-track their digital transformation initiatives. Part of this transformation is the convergence of information technology (IT) and operational technology (OT) networks. While most people are familiar with IT and know the importance of securing computers from viruses and malware, OT security is a relatively newer field. It’s also the latest battleground in the world of cybersecurity.

OT includes the hardware and software for control systems in manufacturing plants, power generators, and distribution networks, and underpins any industrial environment. While OT systems worked in isolation from other systems in the past, that is no longer the case today, especially with the accelerated push for digitalisation. Based on our recent survey of IT and OT security professionals supporting critical infrastructure in large enterprises, 71% of respondents in Singapore say their IT and OT networks have become more interconnected since the pandemic began, higher than the global average of 67%.

A new attack surface

The convergence of IT and OT brings important benefits, from automation and data analytics in power generation plants and factories, to the ability to access and monitor industrial control systems (ICS) remotely - something especially important in a time of social distancing.

Source: Claroty. Stefanescu.

On the flip side, OT systems are now vulnerable to cyberattacks. In the Asia Pacific region, 25% of organisations have already experienced an OT attack, according to a Cisco study. Furthermore, according to Claroty’s Biannual ICS Risk & Vulnerability Report, more than 70% of ICS vulnerabilities disclosed in the first half of 2020 can be exploited remotely.

Whereas IT attacks can be costly, attacks on OT systems can mean tangible harm, as they deal with large-scale physical processes. Sixty-six percent of Singapore-based respondents in Claroty’s survey felt that a cyberattack on critical infrastructure had the potential to inflict more damage during the COVID-19 pandemic compared to an enterprise data breach.

In June this year, Scott Morrison, the Prime Minister of Australia announced that the country’s critical infrastructure had been under attack by a sophisticated state-based actor, while in April 2020, the Israeli government reported an attempted attack on its national water supply. The possibility of a threat actor tampering with the chemical content of a nation’s tap water speaks for itself as to why OT security is paramount.

Fundamental differences between IT and OT

Because of the recent phenomenon of IT-OT convergence, OT security is relatively new and poorly-understood as compared to IT security. One common misconception is that the methodologies and technologies that have been developed over the decades to protect IT also apply to OT.

However, OT networks have different priorities to IT. OT operators are more concerned about system uptime rather than data confidentiality. Downtime for patching, updating and maintenance is a luxury they cannot afford.

Furthermore, unlike the standardised protocols used by IT networks, OT networks usually use proprietary protocols, which are largely unrecognisable by IT security tools and therefore completely incompatible.

While IT and OT security have similar goals in terms of risk reduction, asset and vulnerability identification, and the ability to monitor and detect threats, organisations cannot simply apply their IT security methodology to OT, due to these fundamental differences at play.

The need for purpose-built, integrated OT security

On the other end of the spectrum, cybersecurity professionals may assume that, since OT is different from IT, they need to build their OT security from scratch – with a separate governance programme, a different security operations centre, and creating new processes and controls for their OT networks.

However, this does not scale or provide maximum risk reduction. Instead, organisations should extend their OT management to become part of their existing IT processes.

OT operators will already have a security operations centre (SOC) that runs technology to supply metrics and telemetry from their IT network. Therefore, they need a solution that can plug into their OT networks and provide their SOC the same measurements about outcomes, threats, and alerts. This extends the same level of visibility and reach that they have for their IT networks into their OT networks as well.

With such a unified approach, this means that the same team can manage processes and govern security policies across both OT and IT networks. To ensure that teams can effectively manage OT security, the OT network data also needs to be presented in a way that an IT security specialist can understand it without a steep learning curve.

Furthermore, with the appropriate OT security solution, it is possible to protect industrial networks without downtime, allowing organisations to safeguard their operations without hurting their business priorities.

OT security is a relatively new field compared to its IT counterpart, but its importance cannot be overstated. By understanding the security needs of OT and implementing measures specific to these requirements, organisations can safeguard their operations on all fronts.