IT and OT: two worlds, one attack surface

Digital transformation means connecting the office world and the production world. That is the whole point of it, and it is also where the risk comes from, because the two worlds were built to different requirements, by different people, for very different lifetimes.

Most of the friction between IT security teams and plant teams comes from never having had this conversation openly. It is worth having once, properly, with both sides in the room.

Where they actually differ

Start with priorities. IT protects confidentiality first, then integrity, then availability. OT turns that round: availability and people’s safety come first, then integrity, then confidentiality. Neither order is wrong; they belong to different problems. The cultures follow from it. IT’s instinct is to update fast, OT’s is to disturb nothing, and both were learned the hard way.

• Patching. In IT, regular and largely automated. In OT, rare, because it may need a shutdown, the supplier’s approval to keep the warranty, and on a regulated site a change control with revalidation. On a plant, a patch is a small project.
• A shutdown. In IT, a nuisance. In OT, expensive, bad for product quality and occasionally dangerous, especially when it is unplanned.
• Timing. Office applications tolerate delays of a second or so. A control loop or a motion system works in milliseconds, sometimes less, which on its own rules out several standard security products.
• Life cycle. IT components typically last three to five years and replacing them is routine. In OT, ten to fifteen years is normal and twenty or more is common, with replacement a capital project. A 2009 operating system on a production PC is usually not negligence. It is the machine’s original control system, and the machine still has years of service in it.
• Technology. IT runs on a small set of standard, well-understood protocols. OT runs on a wide mix of protocols, hardware and software, some proprietary, some custom-built, some from vendors who no longer exist.

What follows technically

IT security measures cannot simply be carried over to OT. Try it, and three things happen.

Some tools cannot be installed at all. There is no endpoint protection agent for a PLC, nor for a Windows XP panel PC with 2 GB of RAM running a validated application; and if there were, installing it would be a change to a validated system, with the impact assessment and testing that implies.

Some tools work but have to be set up differently. Vulnerability scanning is the classic example: an active scan that an office network absorbs without noticing can knock a legacy controller offline. Passive monitoring, or a scan scheduled into a planned shutdown, gives most of the value without the risk.

And some controls have to move off the asset entirely. If the device cannot be protected, the protection lives in the conduit around it: what may talk to it, from where, over which protocol. That is the core idea of the zone and conduit model in IEC 62443, and it is the right answer whenever the asset itself cannot be hardened.

What follows organisationally

This is the part that decides whether any of it works.

An IT security team that applies its standard baseline to production will break something, lose the plant’s trust, and spend the next three years left out of decisions. A plant team that refuses any IT involvement will run an unsegmented, unmonitored network until something happens, and then the decisions get taken for them.

What works is unexciting. IT brings the security discipline, OT brings the process knowledge, and neither side has a veto. In practice the plant engineer sits in the design review of the security architecture, and the security engineer sits in the design review of the new line. In the same meeting, not consulted afterwards.

Field knowledge is what makes security applicable on a plant. The failure we see most often is a segmentation project that is correct on paper and was designed without anyone who knew that two particular machines exchange a signal that appears in no document. The first morning after the cut-over, a line stops, and the project loses a year of goodwill.

References

• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023), §2.4 on the differences between IT and OT, including component lifetime, nvlpubs.nist.gov
• IEC 62443-3-2:2020, Security risk assessment for system design (zones and conduits), webstore.iec.ch