IT vs OT Security

1. IT vs OT Security Last month, a Russian cybercriminal group caused chaos along the US east coast by using ransomware to hack into an oil pipeline company’s IT system. The company in return took the extreme measure of proactively shutting down operations to prevent the damage from spreading to the OT system. Their CEO then made the controversial decision of paying $4M in ransom in order to get the pipeline back up and running without further risk. This shocking yet very real story illustrates the ways in which the integration of IT and OT systems has changed the way industries operate. Cybersecurity has become essential not only in safeguarding computer systems, but more so – the very infrastructure we depend upon. IT vs OT security: two entities with two distinct sets of requirements What is the difference between IT and OT security? Traditionally, IT and OT were very different in nature and required entirely separate approaches with regards to safety and security. Information technology involves computers and networks, with the primary currency being data, and the job of IT security is to protect confidentiality. IT vs OT Security What is OT cybersecurity? The top priority of OT security is safety, closely followed by ensuring continuity of service. The legacy nature of OT systems has resulted in something of a convoluted network of software and hardware, industrial elements and adjunct components. Monitoring and protecting so many composite parts is complex and delicate, especially when taking into account the need to keep the system permanently online, as opposed to an IT network, which can be temporarily shut down for security updates. Case in point is the oil pipeline company example: just a few

2. hours offline was enough to disrupt the lives of millions of people with a potential cost of hundreds of millions of dollars. Bringing cybersecurity up to date – the convergence of OT and IT Everything changed about a decade ago with the advent of Industry 4.0, the fourth industrial revolution. Integrating machine-learning and automated processes into industrial technology meant combining both IT and OT which previously have been air-gapped for security reasons. The convergence of the two systems has become more necessary as technology improved and the need for interconnectivity increased. The convergence, however, opened OT systems to many more cyber threats, thus increasing the criticality of OT security. As Industry 4.0 evolved, so too did the cybersecurity measures that protect OT systems. It is now essential for IT security experts to align with OT cybersecurity standards when the two converge, and similarly, those working in OT cybersecurity have to adopt IT security protocols. The convergence of IT and OT is expected to become almost universal, so it’s no longer logical to view these systems as discrete or independent. The future of IT/OT cybersecurity –not “either/or”, but something new entirely Historically, industrial security was reactive, which made sense when dealing with closed systems which were less vulnerable to external attacks. The first major shift that the convergence of IT/OT has highlighted was the need for proactive cybersecurity. The most complex challenge in this respect may be the need to monitor and update OT/IT security systems while keeping them online and fully functional, since frequent updates keep IT systems less vulnerable to attack, and. Since taking an OT system offline is almost certainly going to cause major disruptions (e.g. missed fuel deliveries or water/power outages), proactive OT security specialists use attack simulations as a means of testing network resilience. These simulation models can be anything from an open-source simulator to a physical reconstruction, with many options in-between. Once an accurate model has been created, it is possible to not only pinpoint existing network vulnerabilities, but to actually make data-based decisions regarding changes or updates to be implemented in the (live) physical system itself. Website: https://www.radiflow.com/blog/it-vs-ot-security- understanding-the-differences/