“Safety and security are two sides of the same coin”

Ray Robinson

Director of Operational Technology, NCC Group

Ray has over 30 years’ experience in the Software and Cyber Security industry advising clients on implementing effective strategies in Agile and waterfall project delivery streams, including security and penetration testing. More recently, he’s become and OT specialist working in the Energy, Regulation, Public, Engineering and Finance sector across a 20 year span. In his role at NCC Group, Ray is advising numerous UK Government departments and industrial sector clients on their digital transformation, ICS/OT, cloud, and Cyber Security programmes.

Securing OT to protect people, productivity and profits

For industrial sectors and public utilities, the primary means of generating revenue is their Operating Technology (OT) and their priority is to secure the safety and continuity of output.

Why do businesses that rely on OT to achieve their goals invest more in IT security controls than in protecting their operational assets? A McKinsey report found 96% of business leaders admit they need to invest in OT cyber security. Our recent OT webinar series found just 26% of attendees have a combined safety and security team.

The OT Security Investment Paradox

This paradox leaves industrial organizations extremely vulnerable. When an operational system or machine goes down it can lead to financial losses exceeding $5 million.

There are serious physical safety risks too—a malfunction at the direction of a threat actor could create a life-threatening situation. The attack on the German Steelworks blast furnace could have easily caused the system to overheat and explode. Attacks on water infrastructure could have devastating effects, contaminating the water supply for untold numbers of innocent victims. Officials at American Water (which serves 14 million people in the U.S.) admit they are “unable to predict the full impact” of the recent breach of their internal networks.

So why is there a lack of investment in OT cyber security?

Most just don’t think of OT infrastructure as an attack surface. Industrial teams often turn to OEMs when machinery goes down, assuming it’s a technical malfunction (“turn it off and on again?”).
Security hasn’t kept pace with the Industrial Internet of Things (IIoT) integration. Operators have embraced the benefits of IIoT, but they haven’t recognized the expansion of the attack surface it brings.
Most don’t consider OT cyber security in their downtime cost calculations.
The OT environment is complex and variable. IT cyber security is relatively standardized—there are universal solutions for securing routers, software, etc. But almost every factory and facility have different OT devices and set-ups. Therefore, protecting your bespoke facilities will require a tailored, measured approach.
Until recently, there haven’t been penalties for OT security failures. On the IT side, the SEC, PCI, GDPR, and HIPAA requirements set standards for resilience, response and penalties for security breaches. However, similar mandates have only recently been applied to industry and
critical infrastructure through NIS and NIS 2
.

In the UK, 606,000 workers per year are injured in the workplace on average, with 124 fatalities per year. While individuals bear most of the brunt, these safety incidents can cost employers £3.9BN. Executives have been personally prosecuted for gross negligence manslaughter in the event of workplace fatalities in which they’ve been found to commit a gross breach of duty.

The risks have never been higher. Here’s how to mitigate them.

Between geopolitical issues, global conflicts, not to mention China’s persistent threat, and hacktivists targeting OT systems, organizations must prioritize OT security to prevent financial loss—or worse, loss of life.

Here’s how to convince decision-makers to invest in OT cyber:

Focus on risk calculations. Link OT cyber risk directly to the risk of downtime and the calculated potential losses.
Safety should always be the #1 priority for every organization. Be clear about the potential cost involved—human, reputational and financial.
Manage change effectively.
OT and IT must work together
with new technology introductions, processes or adjustments.
Train people to always be mindful of the security context.
Bring OT, IT and safety to the table. Bring teams together and encourage shadowing or internship style arrangements to encourage collaboration.
Implement the
SANS 5 Critical Controls
.