Establishing a new model for OT security in a turbulent geopolitical climate

While IT ecosystems can implement the latest patches and updates immediately, with relatively little disruption to day-to-day operations, OT represents more of a challenge, largely due to the critical nature of this infrastructure. For example, while a corporate network can be shutdown at a prescheduled time for security updates, citizens depend on water and energy systems in their day-to-day lives, so even the shortest outages are unacceptable.

If regular patching is not viable for OT, then what other paths are there towards world-class security? Organisations such as the National Cyber Security Centre (NCSC) are already working at establishing a model for OT security that will prove effective in the current geopolitical climate and provide operators with a proven, effective model for identifying and fixing vulnerabilities before they can be exploited.
A key factor here is the consolidation of IT and OT under a single Security Operations Centre (SOC), manned by specialists who are deeply familiar with the complexities of OT security, mirroring the increasing convergence of IT and OT across numerous sectors.

This will not only reduce ongoing costs and streamline security operations and improve cross-team and cross-site communication, but also allow for a more effective, holistic approach to monitoring of the entire infrastructure – something that would previously have been costly and difficult to achieve with highly segmented legacy systems. With this as the foundation, the move from a component-based monitoring system to a risk-based one becomes possible.

This involves two distinct types of monitoring:

• Internal monitoring. Ongoing monitoring of the full IT and OT network, based on a digital model of both, encompassing all physical and digital assets. This will help enable a more efficient process for the detection of anomalous activity, which can then be escalated to the appropriate individuals at the SOC to be investigated and resolved.
• OT attack simulation monitoring. Utilising the aforementioned virtual map, ongoing testing can be used to gauge the overall resilience of infrastructure, drawing on the most current cyber threat databases, providing actionable recommendations for optimising security as the threat landscape evolves.

Of course, the path to putting these concepts into practice will vary, depending on organisations’ individual security postures, existing physical and digital infrastructure, and compliance obligations. However, the implementation of a unified IT/OT security system will not only allow organisations to weather the immediate cyber threats posed by global bad actors, but establish a security posture with ample scope to evolve in the future, ensuring they are able to constantly remain one step ahead of cyber criminals’ evolving strategies.

If you would like to explore OT security in greater depth, do not hesitate to contact us.