Cyber security is the broad term given to technologies and processes designed to protect networked equipment, software and data from unauthorized access, attack or damage.

As the world becomes more interconnected, networked equipment, software and data are increasingly susceptible to security breaches. In the past, the protection of such equipment, software and data was the sole responsibility of information technology (IT) teams. However, as more devices are introduced and more operational technology (OT) takes advantage of IT networks, the attack surface becomes more difficult to control and monitor. The attack surface is a point of vulnerability such as a port, device or software interface where an unauthorized user could attempt to enter or extract data from a network. Now, IT and OT teams must work together to assess areas of risk that have not been considered in the past.

What Is Operational Technology?

Operational technology can be hardware or software that controls physical devices or processes in specific environments, such as buildings, factories and utilities. In the past, OT systems operated in closed networks creating an “air gap” where they were segregated from the corporate IT network and the external Internet. Today, OT systems are becoming increasingly interconnected and integrated with other IT systems.

One example of OT is a building’s video surveillance subsystem. What was once a closed-circuit television (CCTV) system that did not interact with any other devices or networks now uses the IT infrastructure for data transmission, storage and monitoring.

The attack surface within video surveillance systems has changed virtually overnight. This rapid shift to the IT network has allowed technology advancements in endpoints — such as network cameras — to outpace the network security policies and procedures required to protect them and an organization from being targets in cyberattacks. According to IHS Markit, more than 66 million network cameras were shipped globally in 2016. Many of these units are installed using a mix of wired and wireless networks without network security measures in place to protect them. As cyberattacks on IT networks increase and more integrations of OT systems occur, vulnerabilities are multiplying, drastically increasing the attack surface of OT networks.

While there are similar strategies for securing IT and OT systems on a network, there are also major differences between the two and confusion about who is responsible for securing what. Collaboration on a consistent security strategy across both IT and OT is imperative with the continued rapid growth of connected endpoints.

One major example is the availability requirements of OT systems. Downtime for software upgrades, patches or firmware updates are generally accepted in the IT environment, but can be very disruptive and costly in some OT systems. For example, within physical security subsystems, a simple firmware upgrade can break system integrations, rendering the system inoperative. However, a worst-case scenario is running an outdated software or firmware version with known security vulnerabilities, which can lead to increased risk of attack by a potential adversary. Considerations need to be taken to properly maintain OT systems to minimize downtime; otherwise, lack of routine maintenance will increase the potential for a cyberattack.

As more and more operational functions take advantage of the capabilities that IT networks offer, the attack surface — or number of devices that are no longer in the controlled IT environment — expands. The manufacturers of these devices must provide users with the ability to protect not only from tampering of the device, but also the software used and the data collected by the device.

The Internet of Things (IoT) provides us many examples of challenging devices to protect. For example, utilities want to use IT networks to transmit process control data from substations and monitoring points. These areas are not easily physically protected and the question of component manipulation, along with the data that is being collected, becomes susceptible to inaccuracies. This attack surface provides unpredictable results unless protective measures are instituted.