The air gap is over. Now what?

This is part 1 of 9 of the “OT/IT convergence” series; it continues with part 2, what stops a programme. It starts with the sentence that makes the other eight necessary.

The idea that OT is secure because it is separated and isolated from IT, the air gap, is obsolete.

We do not say this to provoke. It is simply what you find when you walk through a plant with a network diagram in one hand and a torch in the other. On most sites the air gap stopped being true long before anyone decided, as a policy, to give it up.

Why the separation collapsed

From the early 2000s, digitalisation became a condition of competitiveness: to run operations more tightly, to follow a changing market, and more and more to meet regulatory requirements. The COVID-19 crisis in 2020 then did what years of business cases had not. It showed which parts of a business could not function without digital infrastructure, and pushed many organisations into transformation on a timetable they had not chosen.

That timetable is where a good deal of today’s exposure was created. Sites that had never allowed a remote session had to open one, for home working and for vendor maintenance that could no longer arrive on foot. The solutions went in fast, often without a design review, and the risk was accepted because the alternative was stopping production. Some of those temporary arrangements are still in place. Ransomware against industrial organisations has risen sharply over the same period — the figures are in the article on what the attack counts actually say — and the lesson most sites drew was not to close the connection again but to treat convergence as something to design rather than to suffer.

The technical driver is simpler. Production equipment and connected sensors generate data that is only worth something once it reaches IT systems, where it supports decisions, process optimisation, quality and lower energy use. A historian, a predictive maintenance model or an energy programme cannot work on a network nobody can reach.

The same devices are part of the problem. Many industrial IoT endpoints are insecure and some cannot be secured at all: no authentication worth the name, no way to patch, firmware that nobody maintains any more. Each one is a weak point in the system around it.

Shadow OT shows the old model already failed

Plenty of organisations launched digital initiatives without a strategy and without measuring what they were taking on. What grew instead was shadow IT — on the industrial side, shadow OT: software picked up online or written in-house, then installed in a hurry on the industrial systems or network to answer one precise need, with no study, no evaluation and no strategy, and without the approval or supervision of the official IT function. What a site ends up with is a collection of software whose use and risk nobody controls, and whose existence few people inside the company even know about. In the asset-inventory vocabulary these are unmanaged assets, and they are the ones an assessment finds first.

Consider what that does to the air gap argument. Suppose production engineers have installed a remote access tool, a cloud-connected sensor gateway or an unmanaged wireless bridge, because they needed a problem solved this week. The air gap then no longer exists, nobody knows where the holes are, and the security model protects an architecture that has left the building. The usual discovery is a 4G router in a skid panel, installed by a supplier during commissioning, still powered years later.

Shadow IT says less about discipline than about delay. It grows in the gap between what production needs and what the formal process delivers on a timescale production can live with. Banning it rarely works for long. It recedes when the approved route becomes quicker than the unapproved one.

What convergence actually exposes

Connecting operational systems to the IT layers above them exposes OT, and critical manufacturing systems in particular, to threats they were never designed for. Industrial control systems were designed for a world in which the attack surface was physical access to the cabinet. Those assumptions do not hold on a routed network.

A BioPhorum mapping of the IT/OT landscape lays connectivity and cybersecurity risk over the levels of the ISA-95 / Purdue model and BioPhorum’s Digital Plant Maturity Model. Its lesson is worth keeping in mind on any project. Risk is not spread evenly across the plant; it gathers where levels meet, and convergence multiplies exactly those meeting points.

What replaces the air gap

If isolation is no longer the answer, three conditions have to hold in its place.

The first is to follow norms and standards rather than local inventions: IEC 62443 for zones and conduits, ISA-95 for the integration architecture, ISO/IEC 27001 for the management system. The point is not to collect certificates. A design built on standards can be read by a regulator, an auditor and the engineer who takes over the site in five years.

The second is an agile strategy. Threats, technology and regulation all move faster than a five-year plan, and a convergence programme that cannot change direction will be overtaken before it is finished.

The third is to put people at the centre. Most programmes treat that as a communication task, then find out it was the critical path. Two later articles in this series are given to it.

The honest position

Nobody gets to choose whether convergence happens. The choice is whether it happens by design or by accumulation: one gateway, one temporary firewall rule, one vendor laptop at a time, until the architecture is something nobody drew and nobody can defend.

In hindsight the air gap was less a security control than a circumstance of history, and that circumstance has ended. The eight articles that follow are about what to build in its place.

Next, in part 2: the challenges of convergence, human, organisational and technological, starting with the ones that have nothing to do with technology.

The IT/OT landscape reference is BioPhorum, IT Cyber Security Education Series: Information Technology vs Operations Technology, May 2020.