The challenge with securing operational technology is that these systems were developed for reliability and safety, rather than security. Many operational technology systems were developed decades ago and were not designed to be connected to the internet or other external networks. As a result, they often lack basic security features such as encryption, authentication and access controls. Operational technology systems can also prove difficult to update or patch, since they are often deeply embedded in the infrastructure and cannot be easily replaced or upgraded.
Despite these challenges, it is critical that security teams take steps to secure operational technology systems to prevent cyberattacks and malicious threats. Here’s a six-step plan for improving operational technology security and resilience against modern threat vectors.
1. Expand visibility into converged IT/OT segments, taking inventory of all assets on the network.
First identify all the devices and systems connected to the network, as well as any vulnerabilities or potential attack vectors. This information can then be used to develop a comprehensive security strategy that addresses the unique risks and challenges of each system.
Many organizations have large, complex networks that include a wide range of operational technology systems, often spanning multiple facilities and geographic locations. Without a clear understanding of what is on the network, it is difficult to develop an effective security plan. In addition, many operational technology systems are not centrally managed, which can make it challenging to keep track of all the devices and systems in use.
One common approach to gain better visibility over operational technology systems and assets is to use network assessment tools that can identify devices and systems based on their IP address or other network identifiers. These tools can be configured to assess the entire network or specific subsets. They can provide detailed information about each device, including its make and model, operating system and installed software. However, security teams should be sure to choose proven or purpose-built tools for operational technology environments, as the wrong toolsets could cause more damage.
Another discovery approach is to use passive network monitoring tools to identify devices and systems based on their network traffic. These tools can detect and analyze network traffic to identify patterns and anomalies that may indicate the presence of an operational technology system. This approach is particularly useful for identifying devices that may not be visible to network scanning tools, such as legacy systems that do not use standard network protocols. Passive monitoring also has limitations in operational technology deployments, as many of these devices do not speak unless spoken to as they are designed to operate in low bandwidth environments.
2. Assess OT vulnerabilities and security posture
Once assets have been discovered on the network, the next step is to assess their security posture and identify any vulnerabilities or potential attack vectors. Going beyond patch management, it's important for security teams to not only know where they are vulnerable, but understand the relationship between assets, exposures, misconfigurations, privileges and threats across an attack path. This information helps prioritize vulnerability remediation and other security efforts, while freeing up resources to focus on mission-critical work.
For this step, consider vulnerability assessment tools to identify known vulnerabilities in software and operating systems. These tools can also check for compliance with industry standards and best practices, such as the National Institute of Standards and Technology’s Cybersecurity Framework or the ISA/IEC 62443 security standards for industrial control systems.
Penetration testing is another important strategy to apply. Pentesting involves simulating a real-world attack on the system to identify weaknesses, such as misconfigurations or customer code vulnerabilities that could be exploited by an attacker. Pentesting can even reveal weaknesses that are specific only to a specific operational technology environment.
Combining automated vulnerability assessment tools with penetration testing is a potent “one-two” combination for identifying and prioritizing mitigations of vulnerabilities.
3. Develop a holistic OT security plan
Once vulnerabilities have been identified, the next step is to develop a comprehensive security plan that addresses the unique risks and challenges of each system. This may involve implementing technical controls such as firewalls, intrusion detection systems, privileged access management and encryption, as well as administrative controls such as access controls, security policies and procedures and security awareness training for employees.
It’s also important to consider the physical security of operational technology systems. Physical security measures such as access control, video surveillance and alarm systems can help prevent unauthorized access to operational technology systems and reduce the risk of physical damage or sabotage.
4. Keep OT systems updated
Another important aspect of securing operational technology systems is ensuring that they are properly maintained and updated. This can be a challenge for many systems as they may be difficult to update or patch without disrupting critical operations. However, failing to maintain operational technology systems can leave them vulnerable to known and unknown security vulnerabilities as well as to hardware failures and other issues that can cause downtime and disruption. To address this challenge, organizations should develop a comprehensive maintenance and update plan that includes regular security updates, backups and testing of operational technology systems.
5. Develop and test an OT incident response plan
In addition to proactive security measures, it’s critical organizations have a comprehensive incident response plan in place. This plan should be developed across teams and tested so that, should it ever be needed, it can be effectively executed. The plan should include a clear chain of command, procedures for isolating and containing affected systems and a process for communicating with stakeholders and responding to media inquiries.
Responding to security incidents quickly and in a coordinated way gives organizations a chance to minimize the impact.
6. Join the worlds of IT and OT security
Finally, the industry cannot solve operational technology security problems in a vacuum. Cybersecurity, information security, and engineering teams within the organizations must forge partnerships and collaborate to ensure security. These teams must be on the same page about people, technology and processes, governance, standards and regulations and so much more.
Building resilience for OT networks
While IT security investment has skyrocketed in the last several decades, operational technology security spending has lagged. Yet, increases in operational technology security budgets will often deliver a much greater return than IT investment—primarily because security has been such a low priority for many organizations.
Securing operational technology systems can be a complex and challenging task that requires a multifaceted approach, taking years to mature. But the benefits of discovering assets on the network, assessing exposure and risk and developing a comprehensive security plan that includes technical, administrative as well as physical controls, are well worth the time and investment.
