What is Operational Technology Security? OT security explained

Operational Technology (OT) is the custom hardware and software that manages, controls, and monitors complex, single-purpose industrial machinery. This custom hardware and software components are called Industrial Automation and Control Systems (IACS) or Industrial Control Systems (ICS). OT is found across various industries including critical infrastructure ( energy, utilities, rail operations, telecommunication, etc.), healthcare, mining, manufacturing, and other safety-critical environments.

What’s the Difference Between IT and OT Security?

IT Security

IT security governs business-grade hardware and software, including devices, networks, and environments, as well as cloud and virtualised infrastructure, with user and workload management. The types of workloads covered by IT security include workplace applications, websites and apps, analytics, transactional workloads, virtual machines, and containerised apps.

The goals of IT security are data confidentiality, integrity and availability, via secure operations by authorised users.

OT Security

OT security governs devices, networks, and environments incorporating operational technology components. OT components are industrial devices and systems that blend physical and digital technologies and are designed for a specific purpose, such as a data collection unit in a mine, a building management system, or a complex medical device. OT comprises critical systems that must be operationally safe and reliable above all else, with some systems requiring 24/7 operations. A security failure in OT can cause serious harm, including human safety incidents and significant operations disruptions.

The goals of OT security are safe and reliable operations of industrial devices and systems, including secure operations by authorised users. Some OT devices and systems require specific management under industry regulations such as the Critical Infrastructure Act 2018 (SOCI).

OT vs IoT security

Internet of Things security governs the use and management of IoT devices within an environment. While these devices are built for a single purpose, and blend physical and digital technologies, they are not considered critical for safety and reliability like OT devices. Instead, IoT devices are consumer or business-grade devices that can be managed by business IT security, such as an RFID system for tracking company devices or smart lighting control in the office. Security failures with IoT devices and systems can be inconvenient and expensive but are highly unlikely to cause serious harm. The goals of IoT are the same as IT; with an extra focus on device-level data collection and transmission.

Where IIoT security fits into OT

The Industrial Internet of Things (IIoT) refers to specialised IoT devices for monitoring OT environments. As high security is critical for OT environments, it stands that IoT deployed here must meet more stringent security requirements than their consumer or business grade counterparts.

IT and OT convergence

Previously, OT devices and systems existed on fully isolated networks, helping ensure the most secure operating environment. On-site SCADA (Supervisory Control and Data Acquisition) and DCS (Distributed Control System) systems provided the interfaces for remote, real-time streaming and analytic data of OT, requiring security solutions on both ends. Modern systems may now integrate IIoT, cloud SCADA and edge solutions, which only increases the complexity of security required to manage OT, and leads to more IT and OT convergence.

Why is OT cyber security important?

The threat to Critical National Infrastructure (CNI) and critical manufacturing is on the increase, with 93% of industrial organisations experiencing an OT incident in the past year, with 78% of these experiencing more than three intrusions. Businesses and suppliers must act with urgency to avoid major attacks. With OT in critical infrastructure or safety-critical environments, physical-cyber security is even more important.

How can OT cyber security be accurately governed?

Thanks to the internationally recognised standards such as the ISA/IEC 62443 Series of Standards for Industrial Automation and Control Systems and the NIST Guide to OT Security 800-82r3, OT organisations can develop a solid foundational cyber framework, accurately assess risks, design secure systems and controls, and uplift their cyber maturity.