The challenges of IT/OT convergence

In this age of cheap data and connectivity, businesses are increasingly utilising operational data to improve reporting for stakeholders or push the boundaries of efficiency. This may be achieved through data aggregation or utilising cloud-based analytics and machine learning platforms. Implementing these technologies ultimately involves integrating information technology systems with operational technology systems, otherwise known as ‘IT/OT convergence’. While the benefits of collecting and utilising data will continue being realised for years to come, the convergence of these IT and OT systems presents immediate challenges for the teams that manage them, each of whom has different objectives.

IT teams are typically responsible for corporate networks, automating business processes, protecting information property and other financial and business documentation. The primary driver for the IT professional is to support and protect the confidentiality of the business and its employees.

OT teams maintain operational and industrial control systems (ICS), which drive processes that produce the product (or service) that the business sells. Downtime costs significant money and thus the primary driver for the OT professional is to maintain the availability and integrity of the system.

As IT/OT systems converge, the control systems within utilities, resources, manufacturing and infrastructure companies are becoming more connected than ever before and as such are at greater risk of cyber attack. Horror stories have circulated about oil pipelines and car manufacturing lines being shut down due to malware, worms and zero-day exploits. We also hear about poorly secured building automation networks being hijacked, resulting in hundreds of employees being unnecessarily evacuated and a loss of productivity.

Understandably, OT professionals are concerned about connecting to corporate IT systems given that most cyber breaches are unintentionally introduced by human error through USB devices, email phishing, poor password management or social engineering. In contrast, IT professionals are concerned about connecting to older, unsupported legacy OT systems or control networks designed with little consideration to cybersecurity.

The first step in developing a cybersecurity strategy should be to establish a risk profile for every part of the system. It may help to break this down into functional ‘zones’ and understand what network connections (or ‘conduits’) are required for that zone to operate. Protect these conduits using a technology that fits best, be it firewalls, access control list (ACL), an industrial security appliance or a data diode.

Sometimes the single biggest change one can make to an ICS network is to upgrade to managed switches. With managed switches one can control, segment and monitor the health of the network. Additionally, managed switches offer VLAN integration, redundancy and additional security features such as port locking so nobody can connect an unauthorised (and potentially risky) device to the network.

Consider also using change management software that has autosave and check-in features, which allow you to roll back any changes to ICS configurations, whether authorised or unauthorised. It is desirable for your change management software to be able to detect any unauthorised changes resultant of a potential cyber breach.

It is also important to understand that cybersecurity tools designed for modern IT environments may not suit a legacy ICS designed for a network of yesteryear. Consider, for example, an ICS that is end-of-life with known vulnerabilities that can’t be patched and is too costly to replace. It still needs to be secured, and while investigating for vulnerabilities, if IT runs a port scan across the ICS network, it may lock up a PLC and shut down production for 24 hours. This situation can be avoided using passive scanning technologies that don’t introduce new traffic on the network but instead inspect every packet of data. Tools are available that can detect and audit network assets, monitoring for configuration changes and anomalous behaviour, while mapping out the source and destination of all traffic. If there is data flowing to or from an ICS it can be identified and tracked.

A good reference point for developing an IT/OT security framework is provided by the Australian Cyber Security Centre (ACSC), which is introducing various guidelines and frameworks for our public services and critical infrastructure operators. Adopting the IEC-62443 zones and conduits concept is also highly recommended when securing an industrial control system network.

Irrespective of the technologies used when protecting a control system, it’s important that the approach is collaborative between IT and OT teams. Be sure to work with vendors who have a multidisciplinary team, with expertise in both IT and OT environments, and who can offer training and support for the products they supply.

Kade Miller, National BDM Networking and Cyber Security at Control Logic, is a passionate technology and communications professional with over 11 years’ experience in industrial networking, wireless telemetry, electronic engineering, Internet of Things (IoT) and data acquisition solutions. A cybersecurity enthusiast, Kade has further interests in data science and machine learning.

Image: ©stock.adobe.com/au/bas121