IT vs OT security: The Operational Technology Guide For Professionals

IT Security - From Show Off to Pay Off

Since the introduction of the first virus in the 1970s and more so with the rise of the internet in the 1980s, the need to secure information and keep it private has become increasingly important.

Over the years, the IT world has been witnessing a shift in cyber threats. It used to be that programmers launched bothersome viruses and malware to gain reputation in their communities. Today, with the increased reliance of civilization on computers, and the advancements of technology, attackers have become much more sophisticated.

Up until recent years, cyber-attacks remained almost solely within the IT realm – affecting what we would call “standard” computers.

In 2010, the Industrial Cyber Threat Landscape Took a Turn

STUXNET - Though it was not the first cyber-attack to target an industrial environment, STUXNET was the first ICS dedicated attack to receive such global attention. STUXNET is a malicious computer worm believed to be responsible for causing substantial damage to Iran’s nuclear program, ruining almost 20% of its nuclear centrifuges.

Since then, there has been a constant increase in cyber-attacks targeting industrial organizations, affecting different industries such as power grids (Industroyer), energy (Black Energy) petrochemical (Havex), and oil & gas (TRISIS). Hackers are infiltrating industrial networks in order to shut down machines, demand ransom, steal data, and more. The hardware and software that monitor and control the physical components of an industrial network are often referred to as Operational Technology (OT).

Learn how OTORIO's solution for oil and gas cybersecurity ensures operational continuity.

The New Age of Operational Technology

Traditionally, OT was an ‘air-gapped’ environment, meaning that it was not connected to external networks or digital technologies. In recent years, what was known as “traditional OT” has started to change, since the rise of the fourth industrial revolution, also known as "Industry 4.0". Companies taking part in this change have begun implementing new digital solutions in their networks looking to stay ahead of their competition. These solutions aim to increase automation, add “smart” devices, make data more efficient and available, and interconnect networks for convenience.

As part of the interconnection, and in order to make OT components more accessible while being able to collect and analyze data about them, IT and OT networks are also becoming interconnected. This movement is referred to as IT-OT Convergence.
While connecting operational with information technology opens a great door to new opportunities, it also introduces a vast landscape of cybersecurity threats to what was once an air-gapped network.

OT Cyber Security Has Undergone Fundamental Changes

OT has been relying on computers for several decades to monitor or change the physical state of a system, such as the use of SCADA systems to control train traffic on a rail system. In traditional industries, OT security is composed mostly of straightforward physical tasks, including making sure that a machine repeats the same task correctly, an assembly line continues, etc. Since the inception of IT-OT convergence, there has been a shift in how OT is seen in factories, and in its security.

The Blurry Lines Between Operations and Information

Today, OT security mainly stands for the protection of traditional operations and assets from cyber incidents due to the increased connectivity between cyber and physical realms. It involves the detection and mitigation of weak spots and changes in systems that control physical devices such as valves and pumps as well as vulnerabilities stemming from their integration with enterprise software.

Though operational and information technologies are becoming more connected, there are several important differences that both IT and OT staff need to be aware of.

IT vs OT - Four Core Differences

1. Enterprise vs Industry

The most fundamental difference between IT vs OT is perhaps the most important one. The two technologies operate in different environments and serve different purposes. Briefly, IT is the world we all know. Computers, keyboards, screens, and mice. IT environments involve common environments and solutions (the cloud, servers, firewalls, antivirus, etc.), they communicate over known protocols (HTTP, SSH, RDP), and so forth.

Conversely, OT includes completely different components that can be found primarily in industrial environments. These components are often screenless (machinery, PLCs), they communicate over industrial protocols that are never seen on IT networks (e.g., Modbus, Ethernet/IP, Profinet), they lack security tools (firewalls, antivirus), and they are even programmed differently than “normal” computers.

2. IT Prioritizes Confidentiality, OT Focuses on Safety

Because IT primarily involves storage, retrieval, manipulation, and transmission of digital information, data and confidentiality are a top concern. IT security is crucial in every organization in order to keep its data secure and under control.

In OT, the safety and availability of equipment and processes dominate. Dealing with physical systems that must maintain stable values, such as temperature and RPM, requires meticulous control. Lack of control can lead to extensive financial losses due to temporary halts in production or even result in direct physical harm. For example, a ransomware attack that blocks access to operations can lead to a few days of inactivity where each day may be worth millions of dollars.

3. IT Incidents are More Frequent, OT Incidents are More Destructive

While OT incidents may lead to more destructive outcomes, IT has more ways in which it can be manipulated. Simply put, IT has more touchpoints with the internet. These gateways pose higher security risks because each one can potentially be a hack waiting to happen.

OT has a lower number of gateways, making it comparatively safer. However, the potential magnitude of compromised physical equipment tends to be greater than that of a data breach. Even slight OT cyber-incidents can lead to huge financial losses and have damaging ramifications that can affect the general population, such as water contamination and power outages.

4. Security Patching - Every Week vs Every Ten Years

IT components advance so fast and have relatively short life spans, that a network can look completely different only several years apart. In fact, IT security updates are so frequent that many IT vendors have a designated "update day of the week" or "Patch Tuesday".

Security patching does not work the same way in OT. Since patching OT components requires complete shutdowns that halts production, vendors running OT networks rarely patch their components, if at all. Since OT components are rarely updated, they may have many more public vulnerabilities when compared to IT computers. This means that the probability of a successful exploit on an OT system is exponentially higher than on an IT system.

What Does the Future Hold for Industrial IT Professionals?

IT/OT Alignment

It is clear that IT and OT work differently, are used differently, and have different objectives and risks. However, as digital systems continue to connect to industrial systems, the industry will enjoy improved production growth but at the same time, it exposes itself to more cyber threats.

Industry experts predict that IT-OT will only continue to converge. This means that OT administrators should do their best to understand the IT environment, and vice versa - the sooner the better. Gartner recommends that organizations align their standards, policies, tools, processes, and staff between the IT and the business to the changing OT systems. The approach to dealing with the organizational changes in response to IT/OT convergence is called IT/OT alignment.

IT/OT alignment begins with understanding what each environment does and how they differ from each other. A comprehensive cybersecurity strategy that considers the entire security lifecycle, beginning from the production floor and up to the enterprise, is key when looking to advance through the industrial revolution as the new industry champions.

FAQs

What is OT in the IT world?

OT (Operational Technology) in the IT world refers to the hardware and software used to run large-scale business systems. This includes industrial control systems such as SCADA, PLCs, and IIoT systems that monitor and control physical devices such as production lines or factory machinery. OT also includes communication networks connecting these machines across multiple sites, safety systems, and other industrial applications.

What is an IT/OT engineer?

An IT/OT engineer is a professional who has expertise in both Information Technology (IT) and Operational Technology (OT). As an IT OT engineer, you will be responsible for designing, developing, deploying, maintaining and troubleshooting OT systems.

What are examples of OT?

Examples of OT include machine control systems, industrial automation systems, distributed control systems, programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, remote terminal units (RTUs), and intelligent electronic devices (IEDs). OT also includes sensors and actuators that collect data from physical machines or sites and transmit that information to IT systems. Additionally, OT includes industrial controllers, and other devices used to control physical processes and monitor the environment.

Why is OT unique?

OT is unique in that it bridges the gap between the physical and digital worlds. It unites IT processes, such as software development and automation, with OT processes, such as control systems and industrial machinery. OT plays a crucial role in helping organizations leverage their resources to be more efficient and effective. Additionally, the use of OT makes it easier for organizations to monitor their environment in real-time and make informed decisions.

What is OT and IOT security? 

OT and IOT (Internet of Things) security are two related, but distinct areas in cyber security. OT focuses on the use of digital technology to monitor and control physical processes, whereas IOT security is focused on safeguarding communication between connected devices. Both applications are essential for today's organizations as they have become increasingly more dependent on digital systems and communication networks.

Why is OT security critical?

Operational Technology (OT) security is critical for any organization, as it protects the systems and data that an organization relies on to run its day-to-day operations. Without proper OT security measures in place, organizations can be vulnerable to malicious actors who are looking to disrupt operations or steal sensitive information. Additionally, OT security helps ensure compliance with industry regulations and standards, such as NIST 800-82 and IEC 62443.