Cyber threats to operational technology (OT) are rising. Emergent malicious tools are designed to exploit OT vulnerabilities at scale. Chief information security officers (CISO) must protect these systems while also maintaining safety and continuous operations. But many organizations lack an integrated process for responding to cyber threats against OT and IT. Now, CISOs can overcome this challenge by integrating OT into an IT security operations center (SOC).
of CISOs across sectors say their role has expanded in the last two years to include greater management of OT. (The percentage is even higher in certain sectors—for instance, 41% in healthcare.)
ThoughtLab, Cybersecurity Solutions for a Riskier World, 2022
OT-related cyber incident response efforts often need to be coordinated with the physical safety and plant operation teams.
Legacy OT was designed to maximize production response and uptime—not to enable security practices like active probing or terminating active processes based on cyber threat heuristic analysis.
OT staff are often unfamiliar with cyber tools—and IT staff are often unfamiliar with OT systems. This can contribute to risks that disrupt business and jeopardize safety.
Threat detection and response metrics for security vary. IT focuses more on remediating cyber threats, while OT is more focused on mitigation controls to maximize production uptime.
To enhance threat detection and response capabilities across IT and OT, organizations can create a cyber fusion center (CFC). This comprehensive approach integrates core cybersecurity capabilities into a single entity.
A four-step approach to building an OT threat detection and response program involves creating a strategy, expanding visibility in the networks (including gaining an understanding of what normal looks like in your environment), enabling continuous detection and response functions, and facilitating effective response operations.
