On the factory floor, advances in technology mean that lines are more blurred than ever between the spheres of information technology (IT) and operational technology (OT).
“There’s more demand now within the manufacturing space to have that connectivity with the outside world,” said Shaun Wheeldon, a Cyber Security Enterprise Architect specializing in OT for Rolls-Royce.
But with this convergence comes major cyber security risks.
“From a cyber perspective, 15 or 20 years ago, it was great because there wasn’t anything connected to the outside world,” Wheeldon said. “Our OT environments were not designed with those outside connections in mind.”
Leaps forward in automation, applications, and devices connected to the internet of things mean “we are seeing more of an expansion of our attack surface,” he said.
What are these additional challenges raising threat levels and vulnerabilities for cyber attacks in the OT space? Wheeldon’s insights on the topic include:
- Not knowing what you have: Manufacturers may not know every device or machine that has a connection to the outside world and thus could open a gateway for an attack. The technical term is “asset visibility,” and gaining that clear vision is a tough task that often requires some outside assistance.
- Cultural divide: Let’s be honest: OT and IT teams don’t always speak the same language. For OT, it’s about avoiding operational disruption and maintaining physical safety. IT teams focus on data integrity and being cyber safe. This misalignment can create gaps in risk management, so working together to gain a better understanding of the other’s world is key.
- Aging equipment and devices: Machinery on shop floors can be decades old, with interfaces running on software that is now archaic. “I hear some of my counterparts talking about Windows 3.1, or Windows XP, or Windows 7 as the underlying operating system for a lot of machinery within the operational environment,” Wheeldon added. Getting those machines upgraded to a supportable level is tough work.
What can be done to address these challenges? Here are four best practices from Wheeldon to boost cyber security in the OT world:
1. Adopting zero trust: Opting for zero trust means embracing a security model that operates on the principle of "never trust, always verify." Instead of assuming that anything inside the network perimeter is inherently trustworthy, zero trust requires continuous verification of all users, devices, and applications before granting access to any resources. This can be accomplished, Wheeldon said, with network switches, firewalls, or a virtual segmentation strategy that isolates devices and tightly manages communication pathways.
2. Discovering assets: Using passive asset discovery provides manufacturers with a detection system to develop a comprehensive asset database. That database then provides full visibility of all the devices, hardware, and software within a manufacturing facility. And with that visibility, there are tools to help evaluate vulnerabilities and prevent breaches.
3. Learning the baseline: Behavioral anomaly detection is a solution that allows manufacturers to gain full understanding of what “normal” looks like for their systems, so that any deviations from that norm — like from malware — get identified rapidly and ideally isolated and contained.
4. Building in security from the start: This concept is “one that we've been banging the drum on for as long as I can remember,” but remains paramount, Wheeldon noted. Security must be involved at the outset in the design and change management process because retrofitting is invariably more complex, more costly, and less effective.
The key threads when weaving OT security into the converged world with IT are full visibility of all devices and equipment, and as much segmentation as possible so that breaches can be contained, Wheeldon said
Through it all, people and processes need as much attention as the systems and technology themselves, he said adding: Suppliers of all sizes can embrace that lesson.