With the continued contraction of the gap between the Industrial Control System (ICS) or Operational Technology (OT) network and Information Technology (IT) network, it is apparently obvious now more than ever, that close attention should be given to the security of the OT network. The peculiarity of the OT network (critical infrastructure network) whose compromise can result in loss of lives, environmental degradation, equipment damage, reputational damage etc. makes it attractive to various types of hacktivists, including state sponsored attacks.
There is an increasing demand for plant data in the enterprise (IT) network by plant managers, engineers, OEMs and other stakeholders. This is motivated by the drive to improve plant efficiency, predictive maintenance strategy, process and yield optimisation.
We have moved beyond the era when OT networks are fully air-gapped from IT (enterprise) networks. Even when these two networks are sandwiched by DMZ(s), the potential for attack is more imminent now than ever. Just like the popular saying, “it is not a question of if your network will be attacked but when”. Security of the OT network from cyber attack is not a destination, but a journey. Meanwhile, it is not all gloom and doom. Adopting a defense-in-depth (multi-layer) approach to OT cybersecurity will enhance the security posture of the network and the associated infrastructure. The recommendations provided by various frameworks (NIST, IEC, NERC, ISA, ISO) complements the multilayer security strategy.
In 2024, If you think your industrial network is secured enough without establishing a robust OT cybersecurity programme, think again. You may be closer to a compromise than you think. Securing the OT network is no longer business as usual.
