How Can Operational Technology Assessments Help Bridge the IoT Divide?

In the next segment of our Cybersecurity Awareness Month series, we’re taking a closer look at the importance of securing Internet of Things (IoT) assets and operational technology (OT) networks and why an OT assessment is essential to a successful enterprise management strategy.

The Internet of Things (IoT) has ushered in a new era where data flows freely, enabling data-driven decision-making, operational resource optimization and more. However, as IoT assets find their place within enterprise management systems, several challenges and potential risks may arise.

The glaring disconnect between the meteoric rise of maturity in information technology (IT) networks and somewhat dormant operational technology (OT) networks has the potential to magnify these risks. While many organizations understand how critical IoT and OT security is to their business operations, the robust security programs they’ve adopted to address standard IT system vulnerabilities rarely address their IoT/OT assets in tandem.

Why is it necessary to address IoT and OT assets in your security program? Let’s take a closer look at the potential challenges and risks that this convergence of IoT technology and OT assets bring, then examine a few ways to manage and mitigate those risks.

It’s no secret that that the IT industry has matured greatly over the past 10 years. The proliferation of new standard security protocols and frameworks like zero-trust strategies and modern identity and access management programs has forced the IT industry to mature quickly to ensure that critical data and infrastructure remains protected in the ever-evolving threat landscape.

This maturity level in IT, however, rarely translates to operational technology networks. While IT networks largely revolve around data management, cybersecurity and business applications, OT networks take on the role of managing and controlling physical processes, such as manufacturing, energy production and building automation. OT networks may not implement the same best practices or security hygiene that IT networks do, like defining a user access control list or pinning down vulnerable ports.

In fact, these two worlds don’t even necessarily “speak” the same language — until a breach occurs.

Recently, in an effort to reap the vast capabilities of the Internet of Things, businesses have begun integrating IoT assets into enterprise management systems — and OT networks by extension. As these two worlds converge, they present a set of common challenges harmonizing the traditionally distinct realms of IT and OT.

When IoT devices become part of an enterprise IT system, they open potential entry points for cyberattacks. Because OT systems, like industrial control systems or physical access control mechanisms, often do not have robust security measures built in, they emerge as prime targets for breaches.

For example, much of the manufacturing industry runs on programmable logic controllers (PLCs) — specialized computers designed to automate industrial processes. However, since PLCs have historically been connected to separate OT networks, some may be running on outdated hardware, making them prime targets for attacks.

An attack on an unsecured OT environment through an IoT asset has the potential to wreak havoc on business operations. As OT environments expand and fundamental business operations become dependent on them, this risk of complacency becomes greater. Neglecting proper planning can lead to major business disruptions.

Even something as simple as an external thermometer connected to the network may be vulnerable to a catastrophic attack. If a bad actor decides to adjust the monitored temperature even a few degrees off from the baselines, it can cause the entire system to go down. Worse, if a PLC becomes inoperable, for instance, it can cost hundreds of thousands of dollars in manufacturing costs per minute.

So, what are some ways to mitigate these risks to OT environments?

To confront these challenges and proactively mitigate associated risks to OT environments, organizations everywhere are beginning to turn to operational technology assessments. A worthwhile OT assessment will address your organization’s IoT/OT security risk and position you to better handle malicious attackers well into the future.

Whether your organization is in the industrial, healthcare or commercial space, a good OT assessment can give your organization the direction it needs to determine:

• The number of assets connected to your environment
• The baseline expectations of those assets
• Which events within your environment must be monitored
• Triggers for “problem events”
• A roadmap of gaps to address moving forward

Based on years of experience handling a vast array of IoT/OT challenges, CDW’s OT assessment workshop is designed to provide a baseline for your specific OT environment and IoT devices.

Working collaboratively with your business, CDW will review your IoT/OT security posture by leveraging the CDW 5D Model to assess your current state:

1. Detection. Discovering your organization’s specific business requirements, assessing asset detection, data monitoring, event detection, and asset inventory as well as identity and authentication control.

2. Definition. Defining organizational roles and responsibilities, including policies, alert thresholds, your change management process, a risk management plan, prioritization of assets and a financial impact analysis.

3. Decision. Deciding on your tools, planning and asset lifecycles. This also includes a review of your organizational role assignments and training, an internal communication plan, network segmentation plan and tool selection.

4. Deployment. Deploying tools and assets with a focus on segmentation, policy configuration and enforcement, analysis and refinement.

5. Defense. Defending the future state of your business. This includes a review of your adversity operations plan, incident recovery plan, rapid response roundtable, as well as a quarterly executive review.

From here, CDW experts will map suggested next steps to improve your OT security posture within this 5D framework.

IoT technology will continue to reshape the business landscape in ways we may not have considered yet. As IoT assets become more integrated into enterprise management systems, the importance of bridging the gap between IT and OT networks is more important than ever — and what you know today may save your business thousands tomorrow.

OT assessments can not only help bridge this gap by providing a more intimate understanding of your infrastructure and risks but can identify key vulnerabilities and chart a scalable course to a secure enterprise management strategy as well. With your OT networks secured, your organization will be free to unlock the true limitless potential of IoT technology.