OT solutions increasingly rely on IT infrastructure and services. Whether it’s a company laptop, a phone, or a smart temperature gauge in a fish tank in an individual’s home – the. Office Depot has tech solutions for your business needs. Learn about our computer repair, installation, 24/7 support and simplify your IT.
IT vs. OT for the Industrial Internet – Two Sides of the Same Coin?
IT and OT – What’s the Difference?
Most people are familiar with the term Information Technology (IT). These teams generally work on the enterprise side of things and cover:
“The entire spectrum of technologies for information processing, including software, hardware, communications technologies and related services. In general, IT does not include embedded technologies that do not generate data for enterprise use.”
I’m emphasizing that last part because it plays an important role in the rest of this discussion.
Operational Technology (OT) is a relatively newer term and as Gartner explains:
“Is hardware and software that detects or causes a change through the direct monitoring and/or control of physical devices, processes and events in the enterprise.”
For the purposes of this piece, we’re focusing on OT in the context of manufacturing plants and the assembly line – the teams responsible for the technology and industrial systems that keep the manufacturing process going.
When Worlds Collide - The Industrial Internet
From the explanations above we can see that, traditionally at least, IT and OT have had fairly separate roles within an organization. However, with the emergence of the Industrial Internet and the integration of complex physical machinery with networked sensors and software, the lines between the two teams are blurring.
Remember that portion of the IT definition I highlighted earlier, “In general, IT does not include embedded technologies that do not generate data for enterprise use”?
Well, one of the main reasons these industrial systems and appliances are being brought online is to deliver smart analytics - using data generated from the machines to modify and optimize the manufacturing process. Generating data for enterprise use? That’s starting to sound more like traditionally IT territory.
Now, this convergence of OT and IT isn’t exactly news; Gartner predicted this back in 2011. However, in more recent years we’ve noticed the scope of Industrial Internet has started to explode into more general Internet connectivity, as opposed to the historically closed systems that relied more heavily on physical security to ensure integrity. With this shift from closed to open systems comes an even greater interdependence and overlap between the two teams and a slew of new security concerns.
New Concerns for Both Sides
Greater connectivity and integration is obviously beneficial for smart analytics and control, but more connections and networked devices means more opportunities for security holes. While security has always been a priority for both IT and OT teams in traditional systems, these networked systems are presenting new scenarios and risk profiles to both sides. IT now needs to start thinking like OT and vice versa.
New Concerns for IT
Greater scope of impact – There’s no downplaying the obvious detrimental results of a security incident in a more traditional enterprise environment, but the effects of an incident on an industrial system are on a completely different scale. Consider the repercussions if an electricity grid went offline, or if a car’s engine control system was hacked and drivers were no longer within complete control.
Physical risks and safety – Unlike more traditional enterprise systems, networked industrial systems bring an element of physical risk to the table that IT teams have not had to think about. An interruption in service or machine malfunction can result in injury to plant floor employees or the production of faulty goods, which could potentially harm end users.
Outdated or custom systems – IT is used to frequent and consistent software patches and upgrades, but the industrial environments tend to be more systemic, where one small change can trigger a domino effect. As a result, many legacy plant control systems may be running outdated operating systems that cannot easily be swapped out or a custom configuration that isn’t compatible with IT’s standard security packages.
New Concerns for OT
Physical risks and safety – Threats to physical safety are not a new concern to OT teams; they’ve been implementing safety measures into industrial systems for decades. However, they’re now facing threats that are potentially outside of their control. Taking machines and control systems out of a closed system brings the threat of hacked machines, which could potentially injure employees (e.g. overheating, emergency shut-offs overridden, etc.).
Productivity and quality control – Losing control of the manufacturing process or any related devices is any OT team’s worst nightmare. Consider a scenario where a malicious party is able to shut down a plant, halting production entirely, or reprogram an assembly process to skip a few steps, resulting in a faulty product that could potentially injure end users down the road.
Data leaks –While data breaches have long been a top concern for traditional IT teams, they are somewhat new territory to OT teams that are used to working with closed systems. Given the nature of the types of industrial systems that are coming online, such as utilities, aviation and automobile manufacturing, ensuring the privacy of transmitted data is critical.
Working with IT – One of the more unexpected concerns I hear from OT teams is around how to work with IT to solve the security threats discussed above, when IT teams generally have little experience with industrial systems and their traditional security solutions typically aren’t compatible with legacy control systems. While many on the OT side see the benefits of moving away from closed systems and increasing connectivity, the perceived lack of IT experience and potential solutions for their security concerns is causing some resistance.
Finding Common Ground
While OT and IT may have different backgrounds framing their concerns about the transformation brought about by the Industrial Internet of Things, the main underlying concern for both parties is retaining control of systems and machines and ultimately the safety of their employees and customers. To make both sides happy, key components of any potential security solutions should include:
- Identifying and authenticating all devices and machines within the system, both within manufacturing plants and in the field, to ensure only approved devices and systems are communicating with each other. This would mitigate the risk of a hacker inserting a rogue, untrusted device into the network and taking control of any systems or machines.
- Encrypting all communications between these devices to ensure privacy of the data being transmitted.
- Ensuring the integrity of the data generated from these systems. As mentioned earlier, smart analytics are a major driver in the adoption of the Industrial Internet, but those analytics are worthless if the data is inaccurate.
- Assuming the manufactured goods contain software or firmware themselves, enabling the ability to perform remote upgrades down the road and ensuring the integrity of those updates.
If things continue as they are today, it’s likely we will see the separation between OT and IT continue to fade until they are potentially one and the same. In the meantime, it’s essential that both sides consider the other’s expertise and point of view and work together toward the ultimate goal – a secure, productive Industrial Internet.
Ot Solutions Laptops & Desktops Driver Download For Windows 10 Windows 7
If you’re concerned about the security risk of the Industrial Internet and want to discuss solutions with a member of the GlobalSign team then contact us today.
Operational technology (OT) is hardware and software that detects or causes a change, through the direct monitoring and/or control of industrial equipment, assets, processes and events.[1] The term has become established to demonstrate the technological and functional differences between traditional IT systems and Industrial Control Systems environment, the so-called 'IT in the non-carpeted areas'. Examples of operational technology include:
- Computer Numerical Control (CNC) systems, including computerized machine tools
- Scientific equipment (e.g. digital oscilloscopes)
- Building Management and Building Automation Systems, (BMS)/(BAS)
- Lighting controls both for internal and external applications
- Energy monitoring, security and safety systems for the built environment
- Transportation systems for the built environment
Technology[edit]
Usually environments containing Industrial Control Systems (ICS), such as: supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), Remote terminal units (RTU) and programmable logic controllers (PLC) as well as dedicated networks and organization units. The built environment, whether commercial or domestic, is increasingly controlled and monitored via 10's,100's and 1,000s of Internet of Things (IoT) devices. In this application space, these IoT devices are both interconnected via converged technology edge IoT platforms and or via 'Cloud' based applications. Embedded Systems are also included in the sphere of operational technology (e.g. SMART instrumentation), along with a large subset of scientific data acquisition, control & computing devices. An OT device could be as small as the ecu of a car or as large as the distributed control network for a national electricity grid.
Systems[edit]
Systems that process operational data (including electronic, telecommunications, computer systems and technical components) are included under the term operational technology.
OT systems can be required to control valves, engines, conveyors and other machines to regulate various process values, such as temperature, pressure, flow, and to monitor them to prevent hazardous conditions. OT systems use various technologies for hardware design and communications protocols, that are unknown in IT. Common problems include supporting legacy systems & devices and numerous vendor architectures and standards.
Since OT systems often supervise industrial processes, most of the time availability must be sustained. This often means that real time (or near-real time) processing is required, with high rates of reliability and availability.
Laboratory systems (heterogenous Instruments with embedded computer systems or often non standardized technical components used in their computer systems) are commonly a borderline case between IT and OT since they mostly clearly don't fit into standard IT scope but also are often not part of OT core definitions.
Protocols[edit]
Historical OT networks utilized proprietary protocols optimized for the required functions, some of which have become adopted as 'standard' industrial communications protocols (e.g. DNP3, Modbus, Profibus, LonWorks, DALI, BACnet, KNX, EnOcean). More recently IT-standard network protocols are being implemented in OT devices and systems to reduce complexity and increase compatibility with more traditional IT hardware (e.g. TCP/IP); this however has had a demonstrable reduction in security for OT systems, which in the past have relied on air gaps and the inability to run PC-based malware (see Stuxnet for a well-known example of this change).
Origins[edit]
The term Operational Technology as applied to industrial control systems was first published in a research paper from Gartner in May 2006 (Steenstrup, Sumic, Spiers, Williams) [2]and presented publicly in September 2006 at the Gartner Energy and Utilities IT Summit. Initially the term was applied to power utility control systems, but over time was adopted by other industrial sectors and used in combination with IoT.[3] A principal driver of the adoption of the term was that the nature of operational technology platforms had evolved from bespoke proprietary systems to complex software portfolios that rely on IT infrastructure. This change was termed IT OT convergence.[4] The concept of aligning and integrating the IT and OT systems of industrial companies gained importance as companies realized that physical assets and infrastructure was both managed by OT systems but also generated data for the IT systems running the business. In May 2009 a paper was presented at the 4th World Congress on Engineering Asset Management Athens, Greece outlining the importance of this in the area of asset management [5]
Industrial technology companies such as GE, Hitachi, Siemens, ABB and Rockwell are the main providers of OT platforms and systems either imbedded in equipment or added to them for control, management and monitoring. These industrial technology companies have needed to evolve into software companies rather than being strictly machine providers. This change impacts their business models which are still evolving [6]
Security[edit]
From the very beginning security of Operational Technology has relied almost entirely on the standalone nature of OT installations, security by obscurity. At least since 2005 OT systems have become linked to IT systems with the corporate goal of widening an organization's ability to monitor and adjust its OT systems, which has introduced massive challenges in securing them.[7] Approaches known from regular IT are usually replaced or redesigned to align with the OT environment. OT has different priorities and a different infrastructure to protect when compared with IT; typically IT systems are designed around 'Confidentiality, Integrity, Availability' (i.e. keep information safe and correct before allowing a user to access it) whereas OT systems require 'Realtime control and functionality change flexibility, Availability, Integrity, Confidentiality' to operate effectively (i.e. present the user with information wherever possible and worry about correctness or confidentiality after).
Other challenges affecting the security of OT systems include:
- OT components are often built without basic IT security requirements being factored in, aiming instead at achieving functional goals. These components may be insecure by design and vulnerable to cyber-attacks.
- Vendor dependency: Due to the general lack of knowledge related to industrial automation, most companies are heavily dependent on their OT vendors. This leads to vendor lock-in, eroding the ability to implement security fixes.
- Critical Assets: Because of OT's role in monitoring and controlling critical industrial process, OT systems are very often part of National Critical Infrastructure. As such they may require enhanced security features as a result.
Critical Infrastructure[edit]
Operational Technology is widely used in refineries, power plants, nuclear plants, etc. and as such has become a common, crucial element of critical infrastructure systems. Depending on the country there are increasing legal obligations for Critical Infrastructure operators with regards to the implementation of OT systems. In addition certainly since 2000, 100,000's of buildings have had IoT building management, automation and smart lighting control solutions fitted [8] These solutions have either no proper security or very inadequate security capabilities either designed in or applied.[9] This has recently led to bad actors exploiting such solutions' vulnerabilities with ransomware attacks causing system lock outs, operational failures exposing businesses operating in such buildings to the immense risks to health and safety, operations, brand reputation and financial damage [10]
Governance[edit]
There is a strong focus put on subjects like IT/OT cooperation or IT/OT alignment [11] in the modern industrial setting. It is crucial for the companies to build close cooperation between IT and OT departments, resulting in increased effectiveness in many areas of OT and IT systems alike (such as change management, incident management and security standards) [12][13]
A typical restriction is the refusal to allow OT systems to perform safety functions (particularly in the nuclear environment), instead relying on hard-wired control systems to perform such functions; this decision stems from the widely recognized issue with substantiating software (e.g. code may perform marginally differently once compiled). The Stuxnet malware is one example of this, highlighting the potential for disaster should a safety system become infected with malware (whether targeted at that system or accidentally infected).
Sectors[edit]
Operational Technology is utilized in many sectors and environments, such as:
- Oil & Gas
- Power and Utilities
- Chemicals manufacturing
- Water treatment
- Waste management
- Transportation
- Scientific experimentation
- Critical Manufacturing
- Building Management and Automation
- Building lighting controls and automation
External links[edit]
- Gartner e.g. https://www.gartner.com/smarterwithgartner/when-it-and-operational-technology-converge
- GlobalSign Blog, e.g. https://www.globalsign.com/en/blog/it-vs-ot-industrial-internet/
- NIST e.g. https://www.nist.gov/itl/upload/preliminary-cybersecurity-framework.pdf
- ISA (International Society of Automation) e.g. https://www.isa.org/belgium/standards-publications/ISA99/
- ENISA e.g. https://www.enisa.europa.eu/activities/Resilience-and-CIIP/critical-infrastructure-and-services/scada-industrial-control-systems/maturity-levels or https://www.enisa.europa.eu/activities/Resilience-and-CIIP/critical-infrastructure-and-services/scada-industrial-control-systems/maturity-levels/at_download/fullReport
References[edit]
- ^https://www.gartner.com/it-glossary/operational-technology-ot 'Gartner IT Glossary > Operational Technology'
- ^Steenstrup, Sumic, Spiers, Williams. 'IT and OT Interaction Gives Rise to New Governance'. Gartner.CS1 maint: multiple names: authors list (link)
- ^'The IoT Convergence: How IT and OT Can Work Together to Secure the Internet of Things'.
- ^Steenstrup, Kristian. 'The Strategy, Value and Risk of IT/OT Convergence'.
- ^Koronios, Haider, Steenstrup. 'Information and Operational Technologies Nexus for Asset Lifecycle Management'.CS1 maint: multiple names: authors list (link)
- ^'Industrial Giants Still Struggling To Find New Digital Business Models'.
- ^'IT/OT Convergence: Bridging the Divide'(PDF).
- ^'Internet of Things Forecast Database'.
- ^'Smart Yet Flawed: IoT Device Vulnerabilities Explained'.
- ^'The 5 Worst Examples of IoT Hacking and Vulnerabilities in Recorded History'.
- ^'Gartner Glossary: IT/ OT Alignment'.
- ^'5 TIPS TO IMPROVE IT/OT ALIGNMENT'.
- ^'Mind the Gap - A Roadmap to IT/OT Alignment'.
Ot Solutions Laptops & Desktops Driver Download For Windows 10 64-bit