5 Best Practices for Operational Technology (OT) Security
Operational Technology Security SummitOperational Technology (OT): An Overview
Operational technology (OT) refers to software and hardware that controls physical devices, events, and processes within an enterprise. For example, OT can be used to control subway trains or power stations. Because many enterprises are connecting physical devices and processes using digital tools, the need for OT security is growing at a fast pace.
The Role of Security in Operational Technology (OT)
Traditionally, many organizations have chosen not to upgrade their operational technology, often because this may introduce instability to their systems. A technology that produces consistent results is invaluable, especially when physical processes, which may introduce safety issues, are involved. As a result, organizations often choose to follow the “if it is not broken, do not fix it” principle.
The problem with this approach is that hackers often find ways to penetrate legacy systems. Once they discover a vulnerability, attackers will continue to exploit it as long as they can get away with it. If an organization has not upgraded the operational technology, there is an increased chance that hackers have found a way to penetrate it.
By tightening up security around OT, an organization guards its physical processes and assets, as well as the people and systems dependent on them. This is why safeguarding the technology central to your operation is an important facet of OT security best practices. With the right OT security tools, an organization can maintain operational stability without sacrificing safety. Also, by maintaining high OT cybersecurity standards, a company can pave the way for a legacy of safe, stable operation.
Learn how Siemens achieved secure remote access and connectivity in the challenging OT environment while continuously improving performance and uptime.
Read the success story?Cybersecurity Concerns With OT Integration
One of the primary concerns when it comes to the integration of an OT security framework is downtime. Downtime, especially for a company that depends on operational technology, is extremely expensive. OT cybersecurity best practices therefore need to incorporate strategies for minimizing the impact of downtime while security measures are implemented.
For instance, if a metropolitan train system needs to shut down its operational technology so a cybersecurity system can be implemented, this has to be done at a time that does not bring a city’s transit system to a complete halt. Or in the case of a factory, you need to account for production schedules, when people will be working, and how you can minimize the impact on supply chains that depend on your products. This is especially true because many production facilities depend on Internet-of-Things (IoT) devices that facilitate business-critical functions.
In many situations, significant downtime may be unavoidable, especially if the security integration needs to happen across the board. For instance, you may have to momentarily shut down a supervisory control and data acquisition (SCADA) system for a period of time. This can essentially leave some physical processes headless—without the technology needed to control them. The financial and operational impact of this kind of integration can be significantly diminished with mindful step-by-step planning, another component of OT security best practices.
OT Cybersecurity Best Practices
Some of the OT security best practices for implementing a reliable protection system include:
- Network mapping and connectivity analysis
- Detection of suspicious activities, exposures, and malware attacks
- Implementing a zero-trust framework
- Aligning the right remote access tools
- Controlling identity and access management (IAM)
Network Mapping and Connectivity Analysis
Understanding the physical and digital locations of all devices mapped within a network should be a primary concern of operational technology managers.
For example, if a programmable logic controller (PLC) is communicating with a different PLC due to an error or a hack, it is crucial for the manager to be able to discover this issue, as well as implement a mitigation strategy as soon as possible. This can only be accomplished if the connections of all assets are accurately mapped.
Detection of Suspicious Activities, Exposures, and Malware Attacks
Figuring out the kinds of activity that you will label as “suspicious,” including problematic exposures and malware attacks, is important because you do not want your team to be distracted by false flags. At the same time, underreporting can allow threats to sneak through.
Detecting these kinds of activities and threats is often handled by a security information and event management (SIEM) system. Because the people and technology involved in SIEM systems have a deep familiarity with the threats on the landscape, it is easier for them to assess the kinds of attacks and activity that may impact your operational technology.
You can also identify threats using next-generation firewalls (NGFWs), which can scan data packets streaming into your network from the internet. If a threat is detected, the packet of data associated with it can be discarded, protecting your system and its assets.
Implement a Zero-trust Framework
A zero-trust framework is built on the principle of “never trust, always verify.” Within this kind of system, every person, device, application, and network is presumed to be a threat. Therefore, each of these entities has the responsibility of proving its legitimacy before it is allowed to connect.
This often involves multi-factor authentication (MFA) tools, which require more than one form of identity verification. For example, a team member may be required to present a password, answer a security question, and submit a fingerprint scan. This significantly decreases the likelihood of an attacker finding a way to penetrate your system. In this and other operational technology examples, the focus should be on securing the system while minimizing the amount of extra work required of employees and others. Providing brief training sessions when necessary can streamline the implementation of a zero-trust framework.
Align the Right Remote Access Tools
Ensuring the right people and systems have access to your operational technology is essential, especially because they may be pivotal to the flow of business. An OT system is often different from an IT system because it usually does not have a full selection of tools that can be granularly configured to enable remote access. To account for this difference, administrators should ensure the following receive attention:
- Managing identities and credentials
- Controlling passwords and security
- Multi-factor authentication
- Making sure the right people have the access they need
- Monitoring and managing the access privileges of current and former employees
Control Identity and Access Management
Controlling who is able to access your system plays a big role in your cybersecurity posture, particularly because allowing the wrong person inside may make it easy for an attacker to penetrate. At times, a well-meaning employee may leave their login credentials exposed or otherwise insecure, enabling a hacker to get inside a critical system. Therefore, you should take into consideration the following:
- Educating employees about how to safeguard their access credentials
- Ensuring that a least-privilege policy is maintained across the organization, which limits access rights only to those who absolutely need them
- Canceling the access privileges of former employees as soon as possible
- Revoking access that was temporarily granted to visitors and other guests
Even though it is possible to revoke access privileges too early, it is typically easier to remedy this than it is to recover from a cyberattack.
OT Security and Evolving Cybersecurity Threats
The future of OT security will be driven by the technologies that are now emerging in the industrial and IT space, as well as the security practices that protect them.
IoT Security Tools
One of the most prominent technological shifts involves Industrial Internet-of-Things (IIoT) devices. These are industrial devices that are connected to the internet, allowing them to take advantage of uninterrupted streams of data going to and from cyberspace. But because each of these devices connects to your network, every one represents an expansion of your attack surface. Using IoT security tools can significantly reduce the risk.
Universal Security Monitoring
Universal security monitoring is another consideration that can reduce the chances of a breach. Just because you have a security operations center (SOC) watching over your network does not mean that all devices and systems are adequately monitored.
Making a comprehensive list of all your digital and physical assets, as well as the networks they connect to, is essential in ensuring a universal security monitoring system. It is best to find a solution that provides protection for each and every segment of your network, one that specifically addresses different kinds of threats.
Reliable Forensics
Another factor impacting the future of OT security is the need for tamper-proof forensics. It is impossible to perfectly protect a system, which means that from time to time, some threats may get through. To both recover and plan for a more secure system in the future, you need a forensics system that is tamper-proof. This may require the implementation of an immutable security log system.
How Fortinet Can Help
Securing OT with the Fortinet Security Fabric provides an organization with a comprehensive portfolio of security tools that can protect its operational technology resources. With it, you get a proactive approach to securing your OT. There is no need to source multiple security devices to patch weaknesses or protect desperate assets. The Fortinet Security Fabric ensures all assets within your IT and OT ecosystems get the protection they need.
Learn more about IT Operations (ITOps) and IT Security Policies.
FAQs
What is OT in security?
Operational technology (OT) refers to software and hardware that controls physical devices, events, and processes within an enterprise. For example, OT can be used to control subway trains or power stations.
How do you protect OT?
To protect OT, you should use network mapping and connectivity analysis, implement systems to detect suspicious activity, exposure, and malware attacks, align the right remote access tools, and control identity and access management.
Why is OT security important?
By tightening up security around operational technology, an organization guards its physical processes and assets, as well as the people and systems dependent on them. With the right OT security tools, an organization can maintain operational stability without sacrificing safety. Also, by maintaining high OT cybersecurity standards, a company can pave the way for a legacy of safe, stable operation.
