teissTalk: Reducing the cyber risk to your operational technology

teissTalk host Geoff White was joined by Felipe Garcia Vivanco, Chief Information Security Officer, Scotiabank; and Adnan Ahmed, Head of ICT and Chief Information Security Officer at Ornua;

 

According to Fortinet’s State of operational technology and cybersecurity report, 93% of OT organisations has experienced at least one cybersecurity incident in the past 12 months, more than three-quarters admitted to suffering at least three and nearly half of respondents said their organization suffered an operational outage that affected productivity. See Countdown to Zero day by Kim Zetter on a classic OT attack.

 

Why enhancing OT security is key

 

Any company has OT systems such as HVAC or building management systems, and OT systems often offer easy backdoors to a company’s IT system. What they have in common with the majority of  IoT systems is that they don’t have security designed into them. It’s key to the security of these OT systems that you have vendors you can trust.

 

In factories, the alignment of OT with IT is of the utmost importance, as well as the visibility and the monitoring of equipment data. It’s also key to provide your third parties with access to your system. With third party vendors, one of the challenges is that they may install equipment without your knowledge.

 

Also, your equipment coming from different vendors are all connected to the same network, so if one of them goes down, you need to know how to segregate it from the rest of the network. Awareness of patching OT systems is on the increase but still has got a long way to go as compared to IT.

 

Sometimes it’s not clear whether IT or OT owns a problem when there is a security issue with a machine. According to Gartner,  80% of the problems in OT can be fixed by IT. What you need to focus on is the remaining 20 %, which may not even be IT-based systems but have their own protocols. Patching and updating can cause disruption to production and therefore needs to be done in lunch time or before a new shift starts.

 

Patching OT systems is much trickier than IT as they are decentralised and require different patches for different vendors’ equipment.