The age of digitalization for industrial companies is here. As more and more facilities transition their operations to this setup, they must undertake one essential mission. That task is to develop a proactive cybersecurity strategy for OT. Why is this so important? And what are some suggestions for doing so? Let’s dive in.

IT-OT Integration

Before explaining why such a plan is needed, it helps to understand the environment demanding it. With the turn to digitalization, utility providers such as oil and gas organizations are increasingly merging traditionally separate OT systems with IT. By bringing the two together, goals such as efficiency and productivity are more easily obtainable. However, this trend also means that OT networks are now more likely to be connected to the internet. While convenient for operators, especially considering the rise in remote work, it is convenient for bad actors as well.

OT Security is in Jeopardy

In addition to IT-OT integration exposing OT networks to greater risk, there is a rise in malicious software geared specifically toward OT. On top of that, access to this software has become more readily available. Couple that with a growing interest in OT among cybercriminals seeking monetary or geopolitical gains among other targets, it’s clear that OT security could be in danger.

Recent findings uncovered by Forescout’s Vedere Labs serve as a prime example of this issue. While conducting research, the team found 56 OT security vulnerabilities “threatening devices across the world’s leading industrial manufacturers, including Honeywell, Emerson and Motorola,” as described at Cybersecurity Dive. Included in the potentially impacted devices are engineering workstations, remote terminal units and programmable logic controllers. If taken advantage of, attackers could take a number of manipulative actions and steal pertinent information.

The Time is Now to Step Up OT Cybersecurity

Despite an expanding attack surface, and heightened awareness on behalf of agencies like CISA which issued an alert for industrial control systems in April, OT networks lack preparedness. Fortinet’s 2022 State of Operational Technology and Cybersecurity Report highlights this. After surveying 500 OT security professionals across the globe, the report concluded that “93% of OT organizations experienced at least one intrusion in the past 12 months,” according to MSSP Alert. Most organizations surveyed had only reached a mid-level achievement of thorough OT security though. One of the major challenges they still face is implementing centralized visibility. By approaching this as a priority, companies can better position themselves to prevent future breaches from taking place.

Creating an OT Cybersecurity Plan

One place that organizations can look to when beginning the process of putting together an OT cybersecurity plan is the National Institute of Standards and Technology (NIST). It first released a framework for infrastructure cybersecurity in 2014 and updated the guide in 2018.

Fortinet has also put forth a set of recommendations. Best practices suggested by the company consist of implementing methods such as zero trust access and adopting programs that allow security tools and vendors to be consolidated. Additionally, Deloitte has published a six-point strategy. It includes points of action like running a detailed security assessment, putting together 24/7 monitoring capabilities, offering training for employees and conducting red teaming sessions, which is ethical hacking carried out to test a company’s vulnerabilities.

For options that allow operators to organize cybersecurity management, make sure to review Veracity Industrial Networks’ resources.

Sources:

• “Deloitte Offers Six-Point Cybersecurity Framework” – Automation.com
  https://www.automation.com/en-us/articles/june-2022/deloitte-six-point-cybersecurity-framework?listname=Automation%20&%20Control%20News%20&%20Articles
• “OT Cybersecurity Readiness is Dangerously Behind” – Dennis Scimeca, Industry Week
  https://www.industryweek.com/technology-and-iiot/cybersecurity/article/21244387/ot-cybersecurity-readiness-is-dangerously-behind
• “Dozens of vulnerabilities threaten major OT device makers” – David Jones, Cybersecurity Dive
  https://www.cybersecuritydive.com/news/ot-vulnerabilities-device/625781/
• “Operational Technology (OT) Security and Cyberattacks: Research Reveals Key Trends” – D. Howard Kass, MSSP Alert
  https://www.msspalert.com/cybersecurity-research/operational-technology-ot-security-and-cyberattacks-research-reveals-key-trends/
• “How Your Organization Can Benefit from the NIST Cybersecurity Framework” – Channel Futures
  https://www.channelfutures.com/from-the-industry/how-your-organization-can-benefit-from-the-nist-cybersecurity-framework

Learn about the ultimate solution to protect infrastructure networks, Net-Optix.