1 – Introduction There is a wide range of reliance on operational technology (OT) systems ranging from purely manual to highly automated processes. OT is hardware and software that monitors or controls industrial equipment, assets, processes and events. This OT reliance threatens secure operations due to increasing cyber risk. The objective of this report is threefold: • Raise awareness regarding OT security; • Identify challenges of OT-IT integration; • Present opportunities for collaboration and innovation in the OT-IT domain. OT is prevalent in two broad-scaled sectors, (critical) infrastructure1 and the industrial sector. OT for both sectors includes waste management, water treatment and monitoring of public works such as roads, tunnels, bridges, waterways, rail and aviation. It also entails medical equipment in the healthcare sector, electronic locks in prisons and robotics in horticulture. From distillation units, dams, logistic centers, prisons, hospitals, factories, to airports and railway stations, the push for digitalisation is driving the need for greater cyber protection across the (critical) infrastructure and industrial sector value chain. The vulnerability of OT systems to cyber exploitation can vary dramatically from asset to asset, depending on (1) how the asset's OT and information technology (IT) networks are architected; (2) the extent to which they are integrated; and (3) the hardware, software, firmware and protocols used within the networks. There are numerous real-world examples of how OT systems were exploited.
This distinction between critical infrastructure and the non-critical industrial sector is important; they have different laws to adhere to. In section 3.4, is explained, that laws are in place for organisations in the critical context, such as the Wet Beveiliging Netwerk- en Informatiesystemen (Wbni), but not for parts of the industrial sector that are not defined as critical infrastructure. In addition, organisations providing critical processes are guarded by strict supervisors, this is less the case for the industrial sector. Summarizing, the first type of organisations can find support on a national level, non-vital companies reside in a more unregulated opacity.
Though, by incorporating robust cyber security in Health, Safety & Environment (HSE) measures, the potential of a successful attack and its potential impact can be minimized. As part of the ongoing HSE process, a regular independent review of an OT-domain in the industrial sector, against the IEC 62443 standard combined with the current threat landscape, is recommended to become part of industrial asset management operations. This ensures cyber security policy and measures taken to mitigate the risk are up-to-date to handle current threats.
To summarise, the relevance of the OT/IT security topic is fourfold: • Operational technology (OT) domain culturally has been more safety-aware than security-aware compared with IT, challenging effective security governance and policy in integrated IT/OT environments. • From a security perspective, OT networks have been unmanaged for many years. They are a mix of OT protocols, unidentified assets, legacy systems and devices with unsecure communications. • Applying a “one-size-fits-all” security controls methodology across IT and OT, as well as not fully accounting for differing security requirements, lead to decreased security efficacy from a cyber security perspective. • Information sharing and knowledge centers about security governance and policy in integrated IT/ OT environments in critical infrastructure and the industrial sector can help to boost awareness and implement best-practices. Chapter 2 introduces the convergence of OT and IT Security by describing stakeholders and its opposite system priorities, confidentiality, integrity and availability (CIA, AIC). Chapter 3 looks specifically at Cybersecurity and OT and IT integration. Cyber security challenges in OT are addressed and general and technical challenges are partly matched with cyber security solutions. Overall, the report uses recent literature on the subject in light of contextual examples, together with input from stakeholders, and presents conclusions and recommendations for stakeholders seeking to understand how to navigate emerging OT and IT integration and mitigating cyber security risk. Furthermore, it provides stakeholders with opportunities to fill in knowledge gaps by providing information and best practice to help advance the journey to operational excellence and finetune solutions to support safer, more reliable assets and operations.
