Securing industrial systems in a digital world

Abstract

Operational technology, largely industrial equipment, has become increasingly connected, and the integration of information technology components allows such devices to leverage software that drives data collection and analysis, resulting in enhanced performance and ultimately ‘smarter’ machines. With these benefits come vulnerabilities, including the possibility of malicious actors gaining access to critical assets through networks. The growing recognition of cybersecurity threats to critical infrastructure (e.g. oil, gas, chemicals, energy, water) has brought the topic into the spotlight. Further, regulatory requirements on these industries have increased. Standards and policies have been created in an attempt to address the rapid technological changes; however, it is still challenging for companies to implement needed processes and keep personnel up to date and aligned, given the pace of change. Designing products to be secured from cyberattack only became a topic of concern about a decade ago, and the prevailing sense at that time was that isolation (‘air gap’) and limited availability of technical knowledge (‘security by obscurity’) protected industrial control systems products. This false belief was quickly dismissed as wishful thinking after Stuxnet and vendors began to respond to customer demands for more secure products. However, with often heterogeneous equipment and life cycles counted in decades, it will take time for secure components to become the norm. In this extended abstract we share insights to enhance your understanding of how governance, technology and business requirements intersect, illustrate ways in which organisations can leverage digitalisation opportunities to manage increasing risks better and offer recommendations for organisations to improve their cybersecurity posture in a holistic and sustainable model.