OT is Different From IT and Needs to be Treated as Such

OT systems are often old and sensitive. Many operate complex and segregated technology, machinery and equipment that were not designed to interface with broader networks and several external devices. Pushing greater interactivity with broader networks and the Internet of Things has increased vulnerabilities and security gaps in these systems.

OT systems usually do not have monitoring systems in place. While passive monitoring is common in the IT space, it often does not occur in the OT space. Maintenance schedules typically do not include security updates that add layers of security, as this requires updating vendor contracts to include security requirements. Breaches, therefore, are often overlooked.

OT hackers exploit these failures and penetrate systems by bypassing security protocols or phishing emails. Once their malware is in place, they can manipulate BCS or industrial control systems (ICS) to impact pressure sensors, valves, motors and other equipment (see One wrong click can lead to a 92-day to recovery section for just such a case) (Moody, 2021).

If something breaks due to these activities, workers often assume the problem is caused by equipment failure or maintenance issues. Hackers often continue their attacks even after identifying damage (Moody, 2021). A real-life example of such an oversight includes a Triton/Trisis attack on a Saudi Arabian oil and gas operation. In this case, hackers were on the ICS system for several months; some experts think they were on the system for years (Higgins, 2019).