OT/IT convergence security maturity model

For many years, we’ve watched power corporations try and carry off-the-shelf info know-how (IT) methods into operations know-how (OT) environments. These makes an attempt have had various levels of success. Whereas converging OT and IT brings new efficiencies, it additionally brings new dangers. There are numerous transferring elements to convergence, and there are a number of questions that you should reply, reminiscent of, “Are methods, processes, and organizations on the identical level of their convergence journey?” and “Are dangers nonetheless being managed properly?”

That can assist you reply these questions, this submit offers an assist within the type of a maturity mannequin centered on the safety of OT/IT convergence.

OT environments consist of commercial methods that measure, automate, and management bodily machines. Due to this, OT danger administration should take into account potential dangers to setting, well being, and security. Including widespread IT parts can add to those dangers. For instance, OT networks had been usually extremely segmented to scale back publicity to exterior untrusted networks whereas IT has a seemingly ever-growing community floor. Due to this rising floor, IT networks have built-in resiliency in opposition to cyber threats, although they weren’t initially designed for the operational necessities present in OT. Nevertheless, you should utilize the strengths of Amazon Internet Companies (AWS) to assist meet regulatory necessities and handle dangers in each OT and IT.

The merging of OT and IT has begun at most corporations and consists of the merging of methods, organizations, and insurance policies. These parts are sometimes at completely different factors alongside their journey, making it essential to establish every one and the place it’s within the course of to find out the place further consideration is required. One other objective of the OT/IT safety convergence mannequin is to assist establish these maturity factors.

Patterns on this mannequin usually reference particular features of how a lot involvement OT groups have in total IT and cloud methods. It’s vital to grasp that OT is now not an air-gapped system that’s hidden away from cyber dangers, and so it now shares most of the identical dangers as IT. This understanding permits and improves your preparedness for a protected and safe industrial digital transformation utilizing AWS to speed up your convergence journey.

Getting began with safe OT/IT convergence

Step one in a safe OT/IT convergence is to ask questions. The solutions to those questions result in establishing maturity patterns. For instance, the reply may point out a fast win for convergence, or it’d display a extra optimized maturity degree. On this part, we assessment the questions you need to ask about your group:

When was the final time your group performed an OT/IT cybersecurity danger evaluation utilizing a standard framework (reminiscent of ISA/IEC 62443) and used it to tell system design?

When benefiting from IT applied sciences in OT environments, it’s vital to conduct a cybersecurity danger evaluation to completely perceive and proactively handle dangers. For danger assessments, corporations with maturing OT/IT convergence show widespread patterns. Some patterns to pay attention to are:

The frequency of danger assessments is pushed by danger measures and information
IT applied sciences are efficiently being adopted into OT environments
Particular cybersecurity danger assessments are performed in OT
Threat assessments are performed at first of Industrial Web of Issues (IIoT) tasks
Threat assessments inform system designs
Proactively managing dangers, gaps, and vulnerabilities between OT and IT
Up-to-date menace modeling capabilities for each OT and IT

For extra info, see:

What’s the extent and maturity of IIoT enabled digital transformation in your group?

There are a number of good indicators to find out the maturity of IIoT’s impact on OT/IT convergence in a corporation. For instance, the variety of IIoT implementations with well-defined safety controls. Additionally, the variety of IIoT digital use circumstances developed and realized. Moreover, some maturing IIoT convergence practices are:

Simplification and standardization of IIoT safety controls
Scaling digital use circumstances throughout the store ground
IIoT being consumed collaboratively or inside organizational silos
Built-in IIoT enterprise purposes
Figuring out connections to exterior networks and the way they’re routed
IoT use circumstances recognized and carried out throughout a number of industrial websites

For extra info, see:

Does your group preserve a listing of related property and use it to handle danger successfully?

A vital facet of a very good safety program is having visibility into your total OT and IIoT system and realizing which methods don’t help open networks and trendy safety controls. Since you possibly can’t defend what you possibly can’t see, your group will need to have complete asset visibility. Extremely succesful asset administration processes usually display the next concerns:

Visibility throughout your total OT and IIoT system
Identifies methods not supporting open networks and trendy safety controls
Vulnerabilities and threats readily map to property and asset homeowners
Asset visibility is used to enhance cybersecurity posture
An up-to-date and clear understanding of the OT/IIoT community structure
Outlined places for OT information together with asset and configuration information
Automated asset stock with trendy discovery processes in OT
Asset stock collections which can be non-disruptive and don’t introduce new vulnerabilities to OT

For extra info, see:

Does your group have an incident response plan for converged OT and IT environments?

Incident response planning is crucial for vital infrastructure organizations to attenuate the impacts of cyber occasions. Some concerns are:

An incident response plan that goals to attenuate the consequences of a cyber occasion
The impact of incidents on a corporation’s operations, fame, and property
Developed and examined incident response runbooks
A plan figuring out potential dangers and vulnerabilities
A plan prioritizing and allocating response personnel
Established clear roles and duties
Documented communication procedures, backup, and restoration
Outlined incident escalation procedures
Frequency of response plan testing and cyber drills
Incident response collaboration between OT and IT authorities
Counting on people versus workforce processes for incident response
Measuring incident response OT/IT coordination hesitation throughout drills
An authoritative choice maker throughout OT and IT for seamless incident response management

For extra info, see:

On the subject of company governance, are OT and IT utilizing separate insurance policies and controls to handle cybersecurity dangers or are they utilizing the identical coverage?

The continued maturity and adoption of cloud inside IT and now inside OT creates a extra widespread setting. A complete enterprise and OT safety coverage will embody dangers throughout the whole thing of the enterprise. This enables for OT dangers reminiscent of security to be acknowledged and addressed inside IT. Conversely, this enables for IT dangers reminiscent of bots and ransomware to be addressed inside OT. Whereas insurance policies may converge, mitigation methods will nonetheless differ in lots of circumstances. Some concerns are:

OT and IT sustaining separate danger insurance policies.
Assuming air-gapped OT methods.
The diploma of isolation for course of management and security networks.
Interconnectedness of OT and IT methods and networks.
Safety dangers that had been relevant to both IT or OT may now apply to each.
OT comprehension of dangers associated to lateral motion.
Singular safety management coverage that governs each OT and IT.
Totally different mitigation methods as acceptable for OT and for IT. For instance, the velocity of patching is usually completely different between OT and IT by design.
Totally different danger measures maintained between OT and IT.
A standard view of danger to the enterprise.
The usage of holistic approaches to handle OT and IT danger.

For extra info, see:

Is there a central cloud heart of excellence (CCoE) with equal illustration from OT and IT?

Consolidating sources into facilities of excellence has confirmed an efficient approach to carry focus to new or reworking enterprises. Many corporations have created CCoEs round safety inside the previous 20 years to consolidate consultants from across the firm. Such centered areas are a central level of technical authority and accelerates choice making. Some concerns are:

Consolidating sources into facilities of excellence.
Safety consultants consolidated from across the firm right into a singular group.
Defining safety focus areas based mostly on danger priorities.
Having a central level of safety authority.
OT and IT groups working uniformly.
Properly understood and utilized incident response choice rights in OT.

For extra info, see:

Is there a transparent definition of the enterprise worth of converging OT and IT?

Safety tasks face further scrutiny from a number of events starting from shareholders to regulators. Due to this, every mission have to be tied to enterprise and operational outcomes. The worth of securing converged OT and IT applied sciences is realized by sustaining and enhancing operations and resilience. Some concerns are:

Safety tasks are tied to acceptable outcomes
The identical measures are used to trace safety program advantages throughout OT and IT.
OT and IT safety budgets merged.
The CISO has visibility to OT safety danger information.
OT personnel are invited to cloud technique conferences.
OT and IT safety reporting is thru a singular chief reminiscent of a CISO.
Engagement of OT personnel in IT safety conferences.

For extra info, see:

Does your group have safety monitoring throughout the complete menace floor?

With the rising convergence of OT and IT, the digital menace floor has expanded and organizations should deploy safety audit and monitoring mechanisms throughout OT, IIoT, edge, and cloud environments and accumulate safety logs for evaluation utilizing safety info and occasion administration (SIEM) instruments inside a safety operations heart (SOC). With out full visibility of site visitors coming into and exiting OT networks, a shortly spreading occasion between OT and IT may go undetected. Some concerns are:

Consciousness of the increasing digital assault floor.
Safety audit and monitoring mechanisms throughout OT, IIoT, edge, and cloud environments.
Safety logs collected for evaluation utilizing SIEM instruments inside a SOC.
Full visibility and management of site visitors coming into and exiting OT networks.
Malicious menace actor capabilities for harmful penalties to bodily cyber methods.
The downstream impacts leading to OT networks being shut down on account of security issues.
The power to securely function and monitor OT networks throughout a safety occasion.
Advantages of a unified SOC.
Coordinated menace detection and fast sharing of indicators enabled.
Entry to groups that may map potential assault paths and origins.

For extra info, see:

Does your IT workforce totally comprehend the variations in precedence between OT and IT with regard to availability, integrity, and confidentiality?

Downtime equals misplaced income. Whereas that is true in IT as properly, it’s much less direct than it’s in OT and may usually be overcome with a wide range of redundancy methods. Whereas the OT components for information and methods is availability, integrity, then confidentiality, it additionally focuses on security and reliability. To develop a holistic image of company safety dangers, you should perceive that methods in OT have been and can proceed to be constructed with availability as the important thing element. Some concerns are:

Availability is significant in OT. Programs should run in an effort to produce and manufacture product. Downtime equals misplaced income.
IT redundancy methods won’t immediately translate to OT.
OT homeowners beforehand relied on air-gapped methods or layers of defenses to realize confidentiality.
Should have a holistic image of all company safety dangers.
Safety defenses are sometimes designed to wrap round OT zones whereas limiting the conduits between them.
OT and IT dangers are managed collectively.
Implement widespread safety controls between OT and IT.

For extra info, see:

Are your OT help groups engaged with cloud technique?

Given the historic nature of the separation of IT and OT, organizations may nonetheless function in silos. A sign of converging maturity is how properly these groups are working throughout divisions or have even eliminated silos altogether. OT methods are a part of bigger security and danger administration packages inside industrial methods from which many IT methods have usually remained separated. Because the Nationwide Institute of Requirements and Expertise states, “To correctly deal with safety in an industrial management system (ICS), it’s important for a cross-functional cybersecurity workforce to share their diverse area information and expertise to guage and mitigate danger to the ICS.” [NIST 800-82r2, Pg. 3]. Some concerns are:

OT consultants ought to be immediately concerned in safety and cloud technique.
OT methods are a part of bigger security and danger administration packages.
Make it possible for communications between OT and IT aren’t restricted or strained.
OT and IT personnel ought to work together usually.
OT personnel mustn’t solely be told of cloud methods, however ought to be lively members.

For extra info, see:

How a lot of your cloud safety throughout OT and IT is managed manually and the way a lot is automated?

Safety automation means addressing threats routinely by offering predefined response and remediation actions based mostly on compliance requirements or finest practices. Automation can resolve widespread safety findings to enhance your posture inside AWS. It additionally permits you to shortly reply to menace occasions. Some concerns are:

Cyber responses are predefined and are real-time.
Playbooks exist and embody OT eventualities.
Automated remediations are routine follow.
Foundational safety is automated.
Audit trails are enabled with notifications for automated actions.
OT occasions are aggregated, prioritized, and consumed into orchestration instruments.
Cloud safety postures for OT and IT are understood and documented.

For extra info, see:

To what diploma are your OT and IT networks segmented?

Community segmentation has been properly established as a foundational safety follow. NIST SP800-82r3 pg.72 states, “Implementing community segmentation using ranges, tiers, or zones permits organizations to regulate entry to delicate info and parts whereas additionally contemplating operational efficiency and security.”

Minimizing community entry to OT methods reduces the out there menace floor. Sometimes, firewalls are used as management factors between completely different segments. A number of fashions exist exhibiting separation of OT and IT networks and sustaining boundary zones between the 2. As said in part 5.2.3.1 “A great follow for community architectures is to characterize, section, and isolate IT and OT gadgets.” (NIST SP800-82r3).

AWS offers a number of methods to section and firewall community boundaries relying upon necessities and buyer wants. Some concerns are:

Existence of a fringe community between OT and IT.
Degree of audit and inspection of perimeter community site visitors.
Quantity of direct connectivity between OT and IT.
Segmentation is usually examined for menace floor vulnerabilities.
Use of cloud-native instruments to handle networks.
Identification and use of high-risk ports.
OT and IT personnel are collaborative community boundary choice makers.
Community boundary adjustments embody OT danger administration methodologies.
Protection in depth measures are evident.
Community move log information evaluation.

For extra info, see:

The next desk describes typical patterns seen at every maturity degree.

Section 1: Fast wins
Section 2: Foundational
Section 3: Environment friendly
Section 4: Optimized

1
When was the final time your group performed an OT/IT cybersecurity danger evaluation utilizing a standard framework (reminiscent of ISA/IEC 62443) and used it to tell system design?
A primary danger evaluation carried out to establish dangers, gaps, and vulnerabilities
Group has handbook menace modeling capabilities and maintains an up-to-date menace mannequin
Group has automated menace modeling capabilities utilizing the most recent instruments
Group maintains menace modeling automation as code and an agile skill to make use of the most recent instruments

2
What’s the extent and maturity of IIoT enabled digital transformation in your group?
Group is actively introducing IIoT on proof-of-value tasks
Group is transferring from proof-of-value tasks to manufacturing pilots
Group is actively figuring out and prioritizing enterprise alternatives and use circumstances and utilizing the teachings realized from pilot websites to scale back the time-to-value at different websites
Group is scaling using IIoT throughout a number of use circumstances, websites, and property and may quickly iterate new IIoT to fulfill altering enterprise wants

3
Does your group preserve a listing of related property and use it to handle danger successfully?
Guide monitoring of related property with no automated instruments for brand new asset discovery
Introduction of asset discovery instruments to find and create a listing of all related property
Automated instruments for asset discovery, stock administration, and frequent reporting
Close to actual time asset discovery and consolidated stock in a configuration administration database (CMDB)

4
Does your group have an incident response plan for converged OT and IT environments?
Group has separate incident response plans for OT and IT environments
Group has an ICS-specific incident response plan to account for the complexities and operational requirements of responding in operational environments
Cyber operators are skilled to make sure course of security and system reliability when responding to safety occasions in converged OT/IT environments
Group has incident response plans and playbooks for converged OT/IT environments

5
On the subject of company governance, are OT and IT utilizing separate insurance policies and controls to handle cybersecurity dangers or are they utilizing the identical coverage?
Group has separate danger insurance policies for OT and IT environments
Group has some mixed insurance policies throughout OT and IT however won’t account for all OT dangers
Group accounts for OT dangers reminiscent of well being and security in a central cyber danger register
Group has codified central danger administration coverage accounting for each OT and IT dangers

6
Is there a central cloud heart of excellence (CCoE) with equal illustration from OT and IT?
Cloud CoE exists with as-needed engagement from OT on particular tasks
Some illustration from OT in cloud CoE
Growing illustration from OT in cloud CoE
Cloud CoE exists with good illustration from OT and IT

7
Is there a transparent definition of the enterprise worth of converging OT and IT?
No clear definition of enterprise worth from convergence tasks
Group working in direction of defining key efficiency indicators (KPIs) for convergence tasks
Group has recognized KPIs and created a baseline of their present as-is state
Group is actively measuring KPIs on convergence tasks

8
Does your group have safety monitoring throughout the complete menace floor?
Stand-alone monitoring methods in OT and IT with no integration between methods
Restricted integration between OT and IT monitoring methods and will have separate SOCs
Growing integration between OT and IT methods with some holistic SOC actions
Convergence of OT and IT safety monitoring in a unified and world SOC

9
Does your IT workforce totally comprehend the variations in precedence between IT and OT with regard to availability, integrity, and confidentiality?
IT groups lack an understanding of the priorities in OT as they relate to security and availability
IT groups have a excessive degree understanding of the variations between OT and IT dangers and OT groups perceive cyber menace fashions
IT groups being skilled on the priorities and variations of OT methods and embody them in cyber danger measures
IT totally understands the variations and elevated danger from OT/IT convergence and members work on cross-functional groups as interchangeable consultants

10
Are your OT help groups engaged with cloud technique?
Separate OT and IT groups with restricted collaboration on tasks
Restricted OT workforce engagement in cloud technique
Growing OT workforce engagement in cloud safety
OT groups actively engaged with cloud technique

11
How a lot of your cloud safety throughout OT and IT is managed manually and the way a lot is automated?
Processes are handbook and use non-enterprise grade instruments
Automation exists in pockets inside OT
Safety choices are more and more automated and iterated upon with guardrails in place
Guide steps are minimized and safety choices are automated as code

12
To what diploma are your OT and IT networks segmented?
Restricted segmentation between OT and IT networks
Introduction of an industrial perimeter community between OT and IT networks
Industrial perimeter community exists with some OT community segmentation
Industrial perimeter community between OT and IT networks with micro-network segmentation inside OT and IT networks

Conclusion

On this submit, you realized how you should utilize this OT/IT convergence safety maturity mannequin to assist establish areas for enchancment. There have been 12 questions and patterns which can be examples you possibly can construct upon. This mannequin isn’t the top, however a information for getting began. Profitable implementation of OT/IT convergence for industrial digital transformation requires ongoing strategic safety administration as a result of it’s not nearly know-how integration. The dangers of cyber occasions that OT/IT convergence exposes have to be addressed. Organizations fall into varied ranges of maturity. These are fast wins, foundational, environment friendly, and optimized. AWS instruments, steering, {and professional} companies can assist speed up your journey to each technical and organizational maturity.

Extra studying

 You probably have suggestions about this submit, submit feedback within the Feedback part under. You probably have questions on this submit, contact AWS Assist.

Need extra AWS Safety information? Comply with us on Twitter.

James Hobbs

James is a Safety Principal for AWS Vitality & Utilities Skilled Companies. He has over 30 years of IT expertise, together with 20 years main cybersecurity and incident response groups for the world’s largest Vitality corporations. He spent years centered on OT safety and controls. He guides inner safety practices and advises Vitality prospects on OT and IT cybersecurity practices.

Ryan Dsouza

Ryan is a Principal IoT Safety Options Architect at AWS. Based mostly in NYC, Ryan helps prospects design, develop, and function safer, scalable, and revolutionary IIoT options utilizing the breadth and depth of AWS capabilities to ship measurable enterprise outcomes. He’s obsessed with bringing safety to all related gadgets and being a champion of constructing a greater, safer, and extra resilient world for everybody.