Real-World Challenges in OT Cybersecurity: Insights for CISOs

OT cybersecurity presents unique challenges that differ significantly from traditional IT security. Understanding these complexities is essential for CISOs tasked with protecting OT environments. This article explores some of the real-world challenges in OT cybersecurity and offers insights for CISOs to navigate this evolving landscape without compromising operational excellence or security.

1. Complex Environments

One of the primary challenges in OT cybersecurity is the complexity of environments. Many industrial operations rely on a mix of legacy systems and modern technologies, each with its own protocols and operating requirements. For example, an oil and gas facility I worked with was using an older 霍尼韦尔 TDC 3000 DCS alongside Siemens and 罗克韦尔自动化 legacy PLCs. Over time, multiple other DCSs were added, including Experion PKS R3XX, Experion TPS, DeltaV, and Yokogawa Centum, along with 西门子 S7 and newer Schneider Electric PLCs that control different process packages including Modicon and Tricon. Additionally, Safety Manager, Fail Safe, and Triconex systems for shutdown and fire and gas systems were integrated, some isolated and some connected via proprietary communication protocols or Modbus. This environment is highly complex from both a network and protocol perspective, with a mix of legacy and obsolete systems.

Managing such diverse systems requires a deep understanding of each component's nuances. The challenge is compounded when these systems are spread across multiple locations, each with its own network configurations and operational demands. CISOs must develop strategies to protect this complex ecosystem without disrupting critical operations. I have detailed my thoughts about this specific part in my previous article Navigating the Complexities of OT Cybersecurity .

2. Non-Connected Packages

Many OT environments feature subprocesses that run independently from the main control system or are loosely connected through protocols like Modbus. These non-connected packages can significantly alter the required cybersecurity strategy. For instance, a water treatment plant might have standalone systems for different purification stages, each using different communication protocols and security measures.

The challenge here is to develop a cybersecurity strategy that encompasses these disparate systems. This often requires bespoke solutions tailored to each subprocess's unique characteristics while ensuring that the overall security posture remains cohesive and robust. For more on this, read my detailed insights on Navigating Non-Connected Packages .

3. Patching Difficulties

Updating and patching OT systems is not as straightforward as it is in IT environments. OT systems cannot afford downtime due to their critical roles in operations, and patches should be approved by the OEM prior to deployment. For example, shutting down a DCS operation station controlling a utility subsystem of a power plant for patching may disrupt electricity supply to thousands of customers.

The patching process should be clearly defined and enforced to ensure minimal risk to operations. Key considerations include:

• How to receive the patches?
• Clear definition of patch update zones
• Verification of patch authenticity and source
• Methods for delivering patches to the PCN network and air-gapped systems
• Contingency plans for unapproved patches and system failures
• Design considerations for safe patch updates

Additionally, integrating new expansions or updates with existing infrastructure can introduce vulnerabilities if not managed carefully. The challenge for CISOs is to balance the need for security updates with the operational imperative of continuous uptime. This often involves scheduling updates during planned maintenance windows or developing redundant systems that can take over while primary systems are patched. For further reading, see Strengthening OT CIP Cybersecurity .

4. Skills Gap

A significant challenge in OT cybersecurity is the shortage of skilled professionals who understand both IT and OT environments. Many cybersecurity experts have either an IT background or an OT background, but rarely both. This skills gap hinders the effective management of integrated environments where IT and OT systems converge.

To address this, CISOs should consider developing in-house training programs that cross-train IT professionals in OT systems and vice versa. Partnering with educational institutions and industry organizations to develop specialized training programs can also help bridge this gap. Investing in continuous education and certification for cybersecurity staff ensures that they remain current with the latest threats and best practices. Read more on addressing the skills gap in my article Addressing the OT Cybersecurity Skills Shortage .

5. Proprietary Protocols

Proprietary protocols, developed by control systems vendors for their hardware and software, create unique communication environments within OT systems. While these protocols offer optimized performance and functionalities, and in many cases security by design, they also pose cybersecurity challenges due to their closed nature and lack of transparency.

For example, the Stuxnet worm exploited vulnerabilities in Siemens Step 7 software and PLCs, which used proprietary protocols. Similarly, the Triton malware attack on Schneider Electric’s Triconex safety system manipulated these proprietary protocols to disable safety measures.

The challenge for CISOs is to implement risk-based security measures that protect these proprietary systems without access to detailed operational information.

6. IT and OT Integration

The integration of IT and OT environments fundamentally changes the cybersecurity landscape. IT systems prioritize data confidentiality and integrity, while OT systems prioritize availability and safety. When these two environments converge, it creates a broader attack surface.

The COVID-19 pandemic accelerated digital transformation, pushing for remote access solutions and the integration of IT services into OT environments. This convergence exposes OT systems to threats traditionally seen in IT environments, such as malware and phishing attacks. Effective integration requires a unified approach to security, incorporating robust network segmentation, access controls, and real-time monitoring to detect and respond to threats quickly.

This is the main reason I advocate for designing and promoting an Enterprise OT Cybersecurity Program, instead of the traditional OT cybersecurity programs I promoted over the last decade.

7. Budget Justification

Securing a budget for OT cybersecurity initiatives is a significant challenge for many CISOs. Unlike IT cybersecurity, which can often be directly linked to business efficiency and data protection, OT cybersecurity's benefits are less tangible, especially if the production or operation has never suffered from attacks or security disruptions before. Protecting against potential disruptions to physical processes and ensuring operational continuity are harder to quantify in financial terms.

To overcome this challenge, CISOs need to communicate the potential risks and impacts of cyber-attacks on OT systems in terms that resonate with business leaders. This might include detailing the potential financial losses from production downtime, the reputational damage from a breach, and the regulatory fines for non-compliance. By framing cybersecurity as a business enabler rather than a cost center, CISOs can better justify the necessary investments.

Creating a new role as the OT CISO or IT/OT leader reporting to the CISO might help solve this challenge. Read more in my article Embracing the Future of Cybersecurity and in my previous podcast .

8. Incident Response

Developing an effective incident response plan for OT environments is particularly challenging due to the need for specialized knowledge and the critical nature of OT systems. Unlike IT systems, where incidents can often be contained and mitigated with minimal operational impact, OT incidents can have far-reaching consequences, including safety risks and significant downtime. For instance, the functionality of a server in the OT environment is entirely different from one in IT, especially if this server is the main DCS server in a server-based system. Recovery involves specific processes to ensure synchronization and database integrity.

CISOs should develop incident response plans tailored to the specific requirements of their OT environments. This includes identifying key systems and processes, defining roles and responsibilities, and establishing clear communication protocols. Regular drills and simulations can help ensure that the response team is prepared to act quickly and effectively in the event of an incident.

9. Vendor Collaboration

Collaborating with vendors is crucial for securing OT environments, particularly when dealing with proprietary systems and protocols. Vendors can provide valuable insights and support for implementing and maintaining security measures. However, reliance on vendor support also introduces challenges, such as conflicts of interest and the robustness of security measures. Working with independent, non-biased consultants can help evaluate, set rules, and apply quality measures to ensure maximum benefit from vendor relationships.

CISOs should establish strong relationships with their OEM vendors and work closely with them to ensure that security measures are integrated into the system design and maintenance processes. This collaboration should include regular security assessments, sharing of threat intelligence, and joint incident response planning.

10. Future Trends

Looking ahead, the landscape of OT cybersecurity is expected to become even more complex. The increasing adoption of technologies such as the Internet of Things, artificial intelligence, and machine learning introduces new vulnerabilities and attack vectors. Additionally, regulatory pressures are likely to increase, requiring organizations to adopt more stringent security measures.

CISOs must stay informed about emerging trends and technologies and proactively adapt their cybersecurity strategies to address these evolving challenges. This includes investing in advanced threat detection and response capabilities, fostering a culture of continuous improvement, and staying ahead of regulatory requirements.

For insights on future trends, read my article Top 10 OT Cybersecurity Predictions to Watch .

The challenges in OT cybersecurity are numerous and complex, requiring CISOs to adopt a multifaceted and proactive approach.

By understanding the unique characteristics of OT environments, addressing the skills gap, justifying budgets, and collaborating with vendors, CISOs can develop a robust cornerstone of the Enterprise OT cybersecurity program that protects critical infrastructure and ensures operational continuity. As the landscape continues to evolve, staying informed and adaptable will be key to maintaining a strong security posture in the face of emerging threats.