Your OT Is No Longer Isolated: Act Fast to Protect It

Not too long ago, there was a clear separation between the
operational technology (OT) that drives the physical functions of a
company – on the factory floor, for example – and the information
technology (IT) that manages a company’s data to enable management
and planning.

As IT assets became increasingly connected to the outside world
via the internet, OT remained isolated from IT – and the rest of
the world.

However, the spread of Industrial IoT (IIoT) as well as the need
for constant monitoring and tracking information from manufacturing
and assembly lines mean the connection between IT and OT systems
has greatly expanded. OT is no longer isolated. OT is now just as
exposed to the outside world as IT is.

What does this mean for OT security, where hard-to-access
devices needed for 24/7 production are difficult to patch? Let’s
take a look.

The Air Gap Is Gone

Not so long ago, any data exchange between IT and OT operated
via a “sneaker net.” An operator would physically go to a terminal
connected to the OT device, offload data covering a recent period,
and carry the offloaded data to their workstation, where they then
upload it to the organization’s IT system.

It was a cumbersome and slow way to transfer data, but it did
imply a valuable physical separation (air gap) between OT and IT
infrastructures, shielding critical OT devices from typical IT
cybersecurity risks. But, as the song goes, times, they
are-a-changin. In fact, they have been for quite some time now.

Today, we’re seeing OT at the forefront of cybersecurity risk.
Rising ransomware incidents that cripple entire companies and take
down production for long periods of time have a devastating impact
on the sustainability of affected companies, and it trickles right
down the whole value chain.

Case in point: formerly valued at $100m, United Structures of
American Inc. filed for bankruptcy in early 2022, due in large part
to the fact that the steel manufacturing company was the victim of
a ransomware attack where it lost most of its data. And everyone
will remember last year’s attack on Colonial Pipeline.

You Must Adapt and Secure Your OT – Fast

The fast-paced nature of today’s technology environment means we
can’t go back to the old ways of doing things and we have to assume
that OT is going to stay exposed to the outside world. This implies
a need for a different approach to securing OT infrastructure.

There are many proposed solutions to this challenge, but these
solutions often entail completely different architectures, as some
models are now no longer relevant. Replacing existing devices or
changing existing processes to accommodate the new “best practices”
of the day always comes with a high cost in time, resources, and
training.

It impacts the bottom line, so businesses delay the transition
for as long as possible. As we see repeatedly, some businesses will
only find the right motivation for significant cybersecurity
spending after an incident happens.

When the worst-case scenario happens, companies will immediately
find the necessary funds to fix the problem, but it can be too
little, too late – as United Structures found out.

Consider Taking, At Least, Some Steps

If you’ve not secured your OT yet, you need to get started right
away. A step-by-step process can help if the wholesale changes
required to fully protect your OT are simply impractical and
unaffordable.

For example, if at all practical, consider segmenting the
networks used by OT and apply application whitelisting to ensure
that only authorized OT applications can send and receive data over
that network. Keep a close eye on network traffic and analyze logs
so you can catch attackers in the act – before it’s too late.

Where your OT is built using Linux devices, consider live
patching. Live patching continuously updates your hard-to-reach OT
and doesn’t conflict with uptime goals, which usually happens when
you need to reboot to patch.

Whatever your strategy, there is no excuse for leaving your OT
unprotected. That goes for steps like isolating OT networks, but
also for other options – such as applying live patching to
previously unpatched devices.

There won’t be a “good time” to take the first steps. The best
time to start with OT risk mitigation is right now.

This article is written and sponsored by , the industry leader
in enterprise-grade . TuxCare
offers unrivaled levels of efficiency for developers, IT security
managers, and
seeking to affordably enhance and simplify their cybersecurity
operations. TuxCare’s Linux kernel live security patching and
standard and
assist in securing and supporting over one million production
workloads.^[1][2][3][4]

To stay connected with , follow us on
, , , and YouTube.^{[5][6][7][8][9]}