What is OT (Operational Technology)?
Hardware and software that identify and cause change through direct monitoring and control of industrial equipment, assets, and processes.
Operational technology includes two groups:
- Industrial Control Systems (ICS) – Used to monitor and control the infrastructures of power plants, gas and fuel systems, transportation systems, ports, water, and sewage treatment facilities, and many more.
- Building Management Systems (BMS) – Such as air-conditioning, lighting, and elevators.
The essential difference between OT systems and IT (Informational Technology) is that IT systems store and transmit data, while OT systems manage physical processes. Therefore, a cyber incident in an IT environment may damage data, whereas such an incident in the OT environment might endanger human lives. Furthermore, unlike IT systems that are controlled by a team and where there is cyber awareness, many industrial control systems have serious vulnerabilities, for instance:
- Extensive use of components, software and communication protocols that have cyber vulnerabilities.
- Lack of segmentation in some of the control networks, thus, any malware or hacker penetrating any point-of-entry in the network could potentially reach any target in the network.
- Many HMI stations still run outdated operating systems such as Windows XP because upgrading these might disrupt the operation of the ICS.
- OT systems are designed to be separated from corporate computer networks and the Internet. However, as part of the transition to 4.0 Industry, many industrial control networks are often connected to corporate networks and the Internet. It is a problem as these systems are not properly hardened.
- Mapping of work processes and assets is still scarce; many organizations are still unaware of the existing connectivity between control networks, corporate networks, and the Internet, as well as the connection of external suppliers to the control network.
- Operational staffs are yet insufficiently aware of cyber risks associated with operational technology. The problem is exacerbated by the fact that information security personnel limit their field of activity to the IT environment.
When conducting a survey, one must consider all these parameters
- It is recommended to rely on NIST 800-82 and ISA/IEC 62443. When analysing the strategy, one should remember that the leading model here is Purdue, and systems are accordingly constructed. Some firewalls integrate into their IDS products attack signatures for various OT protocols, like Modbus and DNP3 and are therefore preferable. It is also important to note that diodes are also a standard part of the architecture.
- Zero Trust architecture is somewhat challenging as certain OT components, like PLCs, HMI, and controllers, may not support the required technologies or protocols.
- Deploying Patches to OT environments requires strict testing to ensure their installation does not affect operational capabilities or safety. Another key issue is that some OT environments must run almost continuously, so one should prepare for short downtime windows to perform maintenance activities.
- Operational continuity management requires that availability be managed at several levels. In addition to the availability of data and applications, we must also address systems such as electrical infrastructure, heating, ventilation, and air conditioning. These systems may also be affected by cyber incidents and should be prepared accordingly.
- Geographically distributed systems – In cases where there are multiple geographically dispersed sites belonging to the same organization, it is required to check whether there are differences in the level of physical security between them and if yes, are there any risks to OT systems? In such a case, the necessary infrastructure must be planned for security against cyber incidents on these sites.
- Regulatory requirements – if one or more processes pose an environmental hazard, the risk survey will identify this. If a protocol that may constitute an environmental hazard has been identified, one must act in accordance with the regulation and implement the appropriate controls to prevent any environmental hazard due to a cyber security failure.
Madsec’s certified security specialists have certifications in the field and extensive experience, this is reflected in our long list of recommendations. We will be happy to assist you in conducting a risk survey for an OT environment.
