The challenges introduced by this convergence is but one example of the macro trend of digital industrialization, otherwise known as Industry 4.0. This fourth industrial revolution is forcing physical and cybersecurity worlds to congregate. In order to digitally transform their organizations and obtain essential advantages such as automation, machine learning, agility and transparency, business units that have been traditionally siloed are now becoming connected to the world. This of course includes manufacturing. While it may prove highly beneficial to tear down protective walls and open formerly sequestered networks to telemetry data, it also creates attack avenues for hackers, cybercriminals, and advanced malware strains. In the same way that unforeseen cultural and societal influences are introduced to an isolated country that suddenly opens itself to the world, the worlds of OT and IT are finding it difficult to work with another once the initial salutations and acknowledgements are over.
While both acronyms may share a common letter, there is a lot of dissimilarity
into how these two units are managed. IT
deals with digital information, an invisible stream of binary 1s and 0s that
flow between virtualized nodes encased within software-defined infrastructures. OT deals with machines, things you can see
and actually touch that involve processes that have historically been manually
operated. According to Gartner, OT consists of hardware and software that is involved in the
direct monitoring and/or control of industrial equipment, assets, processes,
and events. Traditionally this has
included industrial control systems (ICS), supervisory control and data
acquisition systems (SCADA), and other OT devices. Because OT worked in isolation, cybersecurity
was an afterthought at most. By IP-enabling these systems and devices
however, cybersecurity is now suddenly paramount in order to secure the increased
attack surface that these devices create within your IT estate, as many are not
created with security in mind. OT now must contend with dangers such as
APT (Advanced Persistent Threats) that are not prepared for.
Because of all of this, OT must now not only enhance manufacturing industrial processes, but protect them as well. In order to do so, they must turn to IT who is all too familiar with combatting these menaces. IT however, works in a very different world, and thus brings different experiences and perceptions that do not always coincide with OT. Some of the notable diversities include the following:
While these differences of culture and perspectives present real challenges, they are ones that can certainly be overcome. Time of course is the great equalizer that breaks down communicative barriers and entrenched viewpoints, but time is not something that companies have much of as they race to complete their digital transformations. One approach to help break down communicative differences and encourage greater collaboration between OT and IT is through the implementation of the Duty of Care Risk Analysis Standard (DoCRA). A duty of care risk analysis can identify and evaluate risks and safeguards to develop reasonable security controls. This risk assessment enables IT, legal, and executive teams to communicate in a common language that can be understood and accepted. DoCRA takes all perspectives and develops a security strategy based on their mission, objectives, and obligations. The purpose of a risk analysis is not to identify and align every possible outlying or internal threat with an involved solution. The goal is to define what is “reasonable” and what strategies can make sense to all of the involved stakeholders.
As authors of the Duty of Care Risk Analysis Standard (DoCRA), HALOCK Security Labs has a unique insight on finding that balance with compliance, security, and social responsibility. We look forward to sharing best practices and how to define acceptable risk at the RSA Conference in San Francisco in February 2020. We invite you to join our partner, Jim Mirochnik, as he presents how IT can translate their InfoSec requirements to executives and get the resources you need by simply speaking in a language all teams can understand and accept.
Securing the Budget You Need! Translating Security Risks to Business Value
InfoSec speaks the language of risks and costs, while Business speaks the language of rewards and revenue. The lack of a common language leads to InfoSec struggling to secure the budgets they truly need. This session demonstrates, using case studies, how the invention of Duty of Care Risk Analysis (DoCRA) can create a common language with the Business and help secure appropriate budgets.
If you want to learn more about the collaborative approach of DoCRA, request one of our Duty of Care Risk Analysis (DoCRA) presentations from key conferences this year:
© 2025 HALOCK. All rights reserved.
Privacy Policy Terms of Use Site Map
