Security 5 Myths of OT Cybersecurity

Related Vendors

TXOne networks

FAULHABER Drive Systems

Wuxi InfiMotion Technology Co., Ltd.

The security of OT environments presents companies with significant challenges. At the same time, there are some potentially dangerous myths circulating about this topic. This article dispels five of them.

Mirco Kloss works as Business Development Director DACH at TX One Networks.

Can you protect your production facility with the same means as your office computer? Is an OT environment really isolated from the rest of the world and thus secure by an air gap? Is the top priority in OT security really to protect the network?

There are many questions about how to best protect an OT environment from attacks. The impact of a successful cyber-attack and the associated interruption of production can have fatal financial and reputational consequences for a company. In the healthcare sector, they can even endanger life and limb. Therefore, OT managers should be well informed about the differences and similarities between IT and OT environments. Correcting the most common myths in OT cybersecurity is the first step in this.

Myth #1: OT Systems are Completely Isolated And Therefore Secure

The widespread notion is that OT systems are protected by a so-called air gap. This means that all machines in the OT network are isolated from the outside world, thereby preventing them from establishing external connections. The OT network can thus neither communicate with the internet nor with the in-house IT and is therefore safe from attacks. That’s the theory. However, the practice nowadays is usually different. A fully isolated production environment is more the exception than the rule. And even when it is isolated, it is often only individual machines, rarely the entire network.

In reality, these systems receive updates, have access via a VPN, or possess other remote access. Especially since the COVID-19 pandemic, this has been integrated into many machines to allow control remotely from home in exceptional cases. Many devices also communicate with in-house IT, which, of course, communicates with the internet. Therefore, in most cases, isolation is not present. Even a Wi-Fi stick that makes device maintenance easier, personal laptops, or USB sticks are a way to break the air gap. A fully isolated OT environment thus rarely exists, and accordingly, protection against attacks is not guaranteed.

Myth #2: Protection Against Malware is Also a Priority in OT

In IT, it is common and entirely correct that protecting the network from any kind of malware and exploiting vulnerabilities is the top priority. After all, you want to protect sensitive data. A PC can also be isolated and disconnected from the network if this prevents the further spread of, for example, malware. In production and other OT environments, this is not so easily possible, as the failure of machines can result in significant financial damage that must be avoided at all costs. Also, in the case of medical devices in hospitals, uninterrupted operation is crucial. Think of life-sustaining equipment. A failure of these could have catastrophic consequences.

In OT, ensuring smooth operation is the top priority. The availability of plants and equipment takes precedence. Based on this, solutions must be devised on how the network can be best protected against external and internal attacks without interrupting operations or having to take machines offline temporarily.

Myth #3: OT Cybersecurity is the Responsibility of IT

The shortage of skilled workers in the IT sector is well-known and likely won't be resolved quickly. The situation is no better in the OT sector, quite the opposite. This reinforces the belief that comprehensive cybersecurity only requires a good IT team. However, this team does not have the experience or necessary expertise to ensure the required protection in OT. Similarly, an OT team alone cannot be responsible for IT security.

The only solution is cross-team collaboration, combining the experience and knowledge from both sides to ensure optimal protection for the entire company. This also addresses the skills shortage by ensuring internal IT teams, often already operating at maximum capacity, are not additionally burdened with OT protection; instead, external professionals are consulted. The best security for IT and OT comes from native IT security and native OT security, both of which eventually converge in a Security Operation Center (SOC).

Myth #4: An OT Environment is Protected With a Firewall And Antivirus Solutions

IT focuses its protection mainly on offices and data centers and on confidential data. Longer latency times are less of an issue here than in OT. Additionally, the systems are usually renewed every three to five years. An OT environment is entirely different: individual machines are sometimes in use for ten, 15, or 20 years because they are expensive to purchase and designed for long-term use. Consequently, the software is also outdated. New patches and updates can often only be installed when the machine is offline, which is often avoided for the reasons mentioned.

IT solutions like firewalls, antivirus software, and the like do not work in the OT environment. They are ineffective, barely understand native OT protocols, sometimes require high network latency which isn't present in OT, and offer no solutions for limited computer resources or lack of internet access, which is the case with many OT systems. Other conditions in such environments pose additional challenges, such as high temperatures, humidity, and vibrations. Different approaches and solutions must interact here, like security inspections, endpoint protection, network defense, and virtual patching.

Myth #5: You Can Only Protect What you Know is in the Network.

While IT security primarily focuses on the visibility of vulnerabilities to be patched, OT must first ensure necessary prevention. Merely making a threat visible does not help here. It also requires the ability to eliminate it. Good and comprehensive OT security first identifies the devices, protects them with multilayered adaptive OT protection, detects and analyzes anomalies, and continuously adapts protection using threat data. The key is to avoid a recovery process, which is lengthy and costly.

Specialized Knowledge Needed for OT Security

Those who know the common myths surrounding OT security can avoid mistakes in protecting their own production environment and thus make it more secure. A completely isolated production environment is as much an illusion as adequate protection of it through conventional firewalls or antivirus solutions. This task is therefore not an IT problem but must be handled by specialists in OT security.

The visibility of existing vulnerabilities must always go hand in hand with the prevention of attacks. The key to success for comprehensive cybersecurity across the entire company lies in the collaboration of both IT and OT teams. The smooth and uninterrupted operation of machines is always the top priority.

Secure and Compliant Authentication in Laboratories

Secure & Contactless User Authentication at GMP/GLP