Organisations need to mature their operational technology (OT) security environment as OT increasingly integrates into IT systems, and cyber attackers target OT and critical infrastructure.
This is according to speakers participating in a recent webinar on OT security, hosted by HCL Technologies and Fortinet.
Neelakarun Asari, director and global practice head, Security-of-Things, Cybersecurity & GRC Services at HCL Technologies, said challenges in securing OT systems included that many of them were legacy systems critical for stability or for generating revenue.
“Traditionally, the OT security focus was mainly on safety and operational availability. However, now that industry 4.0 is coming up, OT must integrate with IT, for analytics and various other systems. The OT environment is now exposed to larger threat vectors, and more attacks are targeting critical infrastructure.”
At the same time, he noted: “Many of these OT environments have been running flawlessly for 20 or 30 years, so it is crucial to ensure that this investment is not disturbed and security solutions plug into the system without disrupting it.”
The experts highlighted the importance of working towards greater cyber security maturity in OT environments.
Matthew Taljaard, subject matter expert for OT cyber security in Africa at Fortinet, said: “OT / IT convergence is not going away, and the risk is increasing, so organisations need to tackle this head on with the help of a systems integrator like HCL Technologies and a vendor like Fortinet.”
The OT environment is now exposed to larger threat vectors, and more attacks are targeting critical infrastructure.
Neelakarun Asari, HCL Technologies.
Martin Fernandes, business development manager (Africa), operational technology at Fortinet, explained that organisations needed to consider factors such as connectivity, governance and interdependencies in OT environments.
“Many organisations aren’t capable of providing the full stack of security in these environments, continuously monitoring north-south and east-west traffic and implementing effective identity and access management. OT environments are opening up to the IT environment, but security on the OT side is still segmented and not completely integrated. Many organisations also have complex ecosystems of solutions from various vendors, so securing the environment requires integration and simplified management.”
He highlighted the Fortinet Security Fabric, which provides a comprehensive portfolio of security solutions to protect OT resources, including FortiDeceptor, based on deception technology.
Asari said organisations with low OT security maturity should start by attending to the basics: “The first requirement is to segment the environment, with application and network controls, basic inventory, and basic anti-malware capabilities. Then come next-level controls like basic secure access and identity management, deep OT network security, endpoint detection and response, device hardening, advance inventory and SD-WAN as the minimum required security in an OT environment. It is essential to understand the environment before implementing security and risk mitigation measures, since every environment’s architecture is different.”
He said: “An initial assessment should be done to standardise technology and rollout plans, then organisations should do another assessment at least every two years. As a global systems integrator, we have reachability to support remote sites around the world. Some of our customers have up to 180 sites around the world, and we support them with a centralised model of deployment and field services available locally.”
Share