Operational Technology (OT) Security
The extended internet of things (XIoT) is changing how businesses operate for the better. Smart devices are enabling automation, analytics, and new innovations in ways that were impractical with purely mechanical and analog environments. However, with this shift comes a broad range of new attack vectors for threat actors to exploit. This is particularly challenging in the operational technology (OT) subcategory of XIoT, which often sits at the intersection of industry and modern tech.
Cyberattacks on OT systems — which are often the backbone of critical infrastructure in manufacturing, energy, and transportation — can have devastating real-world consequences. For example, CISA issued a recent cybersecurity advisory related to exploits of programmable logic controllers (PLCs) in water and wastewater facilities.
OT security practices enable organizations to protect the control systems in charge of physical operations from cyberattacks. This article explores the importance of OT security, its core components, and effective practical strategies for mitigating OT security risk.
Understanding operational technology
Operational technology manages processes that interact with the physical world. For example, an automotive manufacturer may build vehicles with welders, assembly robots, and automated paint booths. OT systems manage these machines, continuously monitor their performance, and adjust the control inputs to optimize production.
To better understand how to secure OT systems, let’s review how OT compares to IT, examples of OT systems, and OT’s evolution.
The differences between OT and IT
Though they often interact and are both part of the broader world of XIoT, OT and IT systems have different use cases and security concerns. Security teams must understand these differences to effectively manage risk and implementation.
IT systems: Facilitate communication and data transfer between devices within an organization’s network, enabling access to shared information and applications.
OT systems: Maximize industrial production while maintaining the safety of people and equipment.
Examples of OT systems
OT is a broad category that includes many different device types and technologies that monitor and control physical processes across industries. Common examples of OT systems include:
- Computer numeric control (CNC): Controls the moving part of an individual machine (e.g., a control arm, a paint spray nozzle, a welding gun, a valve opening position, etc.).
- PLC: Manages the operation of a single machine, including all its moving parts, its power supply, and any other complementary systems.
- Distributed control system (DCS): Manages the operation of interconnected machines involved in a common goal (e.g., multiple robots working in parallel to paint a car).
- Supervisory control and data acquisition (SCADA): Focuses on the operations of a larger organization (even when geographically distributed), prioritizing data acquisition and maintaining supervisory control rather than real-time operation.
Evolution of OT
OT historically aimed to reduce human intervention in industrial manufacturing, beginning with CNC machines that enable precise machine control through computer logic. The first CNCs were controlled by rugged, real-time devices isolated from the outside network before evolving to include PLCs, DCSs, and SCADA, which provide real-time remote control and monitoring capabilities via the network.
In modern environments, OT is closely coupled with the organization’s IT infrastructure and exposed to the same vulnerabilities. IT has also evolved to store and manage data accumulated by the OT systems to enhance processes. This data is then used to inform AI/machine learning (ML) models within operations, such as anomaly detection and predictive maintenance.
The importance of OT security
OT sits at the intersection of the physical and digital world, which makes OT systems a prime target for sophisticated threat actors. Organizations that implement OT must be proactive about preventing security breaches that can disrupt real-world processes and lead to potentially catastrophic outcomes.
OT risks and threats
Traditionally, industrial systems were “air-gapped” and disconnected from networks that could serve as entry points for attackers. However, the rise of smart OT systems has led to the connection of OT and IT systems to create a new attack surface that XIoT security strategies must address.
Many OT systems are vulnerable to the common vulnerabilities found in IT systems. Major documented attacks, like the infamous Stuxnet campaign, have exploited vulnerabilities such as:
- Outdated and unpatched software: Organizations often ignore updating or patching OT systems, and in other cases, OT systems remain unpatched by vendors for extended periods. Both situations can leave OT endpoints vulnerable to known exploits.
- Weak authentication: Lack of proper access controls and strong authentication platforms provides an opportunity for attackers.
- Lack of network segmentation: Network segmentation involves separating networks based on use cases and logical data flow, with each subnetwork acting as an independent unit. Without network segmentation, an intruder gaining access to a device will have full access to every other device in the organization.
- Weak asset inventory management: Complete documentation of all assets — including connected networks and assets interacted with during normal operations — is a critical but often overlooked security factor.
- Friction between OT and IT teams: A majority of OT attacks originate from IT systems, making it imperative to reduce the friction between these two teams.
- Human factors: Poor training, poor processes, and even malicious intentions can lead to breaches or attackers gaining physical access to the network.
Impact of OT security breaches
A security breach in an OT system can cause outages or unexpected behavior that directly impacts the organization's production. For a manufacturing or logistics organization, every second that the machines are not operational results in revenue loss. These outages can impact production volume as well as contractual obligations, which can lead to further financial losses and reputational damage.
However, the implications of an OT attack extend far beyond the loss of time and production volume during the attacks. For example, an OT attack at a fast-moving consumer goods organization could result in the incorrect chemical composition of a food item or an onsite safety incident due to equipment malfunction. This could result in both regulatory breaches and reputational damage to the organization.
Three key components of OT security
An effective OT security program requires a three-pronged approach that ensures an organization addresses all aspects of cybersecurity for their OT systems.
Risk assessment and management
Identifying critical assets and vulnerabilities in your organization is the first step to taking control of your OT security. This involves cataloging every device in your OT system and documenting its network entry points, access permissions, and any other complementary devices it uses to operate normally. The next step of risk management is to conduct security audits and remediate vulnerabilities that could expose the systems.
Additionally, it is essential for teams to break down the silos between OT and IT. Understanding the relationship between assets across both IT and OT environments is a prerequisite for implementing strong security controls.
Following security frameworks and standards
Following well-documented and peer-reviewed security frameworks streamlines the process of assessing and managing risk. Some of these frameworks include:
- The NIST Cybersecurity Framework (CSF): Provides a set of voluntary guidelines to improve an organization’s security posture, urging investment in six core functions: govern, identify, protect, detect, respond, and recover.
- ISA/IEC 62443: Defines processes to manage OT security in automation and control systems, such as user roles, process maturity levels, security levels, and system segmentation.
- The Purdue Model: Details best practices relevant to connecting industrial control systems and IT networks. The Purdue Model is particularly relevant to organizations that must integrate and protect both IT and OT systems.
Incident response planning
Management must develop an OT-specific incident response plan to define the exact steps the organization should take in response to an attack. This plan differs from IT incident response planning, and OT stakeholders must own it and work closely with their IT security counterparts in its development. However, defining the plan is not enough — the organization must also practice using drills and simulations to ensure it is followed during an incident.
Strategies for enhancing OT security
OT security requires a strategic approach that includes buy-in from the highest levels of an organization. The four strategies below can help teams build successful OT cybersecurity programs and avoid common mistakes and antipatterns that can impede progress.
Collaboration between IT and OT teams
With the lines between OT and IT blurring, organizations must foster collaboration between OT and IT teams. The intention is not to merge them into the same team but to have them operate together while maintaining their distinct responsibilities. Bidirectional communication must occur before and after incident response. Establishing cross-functional teams empowered by the right technology can help bridge the gap between IT and OT teams.
Understand the security journey
Achieving security maturity isn’t a point-in-time event — it’s a journey that requires understanding where you are today, building your capabilities strategically, and maintaining and refining your security practices over time. Though no two cybersecurity journeys are the same, OT poses unique challenges that organizations must address in a stepwise, progressive fashion.
For example, being able to “see everything” (i.e., having visibility over all internal and external assets) is the foundation all other security practices depend on. That’s why asset discovery is critical in the early stages of an organization’s cybersecurity journey. For a practical example of how an organization matured its cybersecurity practices, check out New York's whole-of-state cybersecurity journey case study.
Implementing advanced security technologies
OT systems must have firewalls, intrusion detection systems, robust identity and access controls, endpoint protection (e.g., endpoint detection and response/endpoint protection platforms), and threat detection systems. Due to the huge variety of attacker tactics, traditional rule-based strategies are no longer effective in intrusion and threat detection. AI- and ML-based detection systems make a big difference here. They can detect anomalies and vulnerabilities and even predict attacks based on external factors.
For organizations that don’t have the resources or capabilities to implement advanced OT security solutions and effectively detect and respond to threats, managed services from cybersecurity vendors and industrial control systems vendors can provide the expertise at a fraction of the cost of building it in-house.
Continuous monitoring and threat intelligence
Managing risk is a continuous process, and prevention is the best mitigation method. Real-time monitoring and continuous threat intelligence help in proactive defense. However, no prevention system is perfect, and visibility that enables rapid detection when a breach does occur is a necessary component of an OT security strategy. Continuous monitoring and threat intelligence can also address this reactive aspect of protecting OT systems. Furthermore, it’s critical for organizations to implement endpoint detection and response, behavioral analysis, and automated incident response.
Conclusion
An OT security breach can disrupt production, cause safety incidents, tarnish reputations, and lead to substantial financial losses. Organizations must prioritize OT security by fostering collaboration between OT and IT teams, implementing AI- and ML-based monitoring, and leveraging continuous threat intelligence.
CrowdStrike Falcon® for XIoT delivers OT security without disruption. It provides real-time visibility into operational technology environments and stops threats across industrial systems from one unified platform. As part of the CrowdStrike Falcon® platform, Falcon® for XIoT delivers enhanced visibility across the entire network, using AI and ML for real-time threat detection and response, and providing endpoint protection alongside automated security policy enforcement to ensure unwavering compliance.
Discover how the Falcon platform can transform your OT security: Start your 15-day free trial today.
