How to stay in control of your OT environment
The challenging context for operational technology
“We’re operating in a very challenging time. In fact, our customers report this is one of the most difficult transitions they’ve ever been through.”
So says Ben Barker, operational technology and industrial product director at ServiceNow, a technology asset and workflow platform that helps companies manage and digitise their ways of working effectively within industrial environments.
He’s talking about the transition to an increasingly converged OT and IT estate and evolving technology complexity in utilities, but also their legacy of much older equipment, and, crucially, how the brave new world of digital interacts with it.
This increased complexity comes as utilities tackle constrained resources, resource scarcity and a volatile political and economic environment.
When it comes to digital, serious cyber threats are now the number two overall strategic risk sitting on most utility risk registers in terms of both impact and likelihood, Barker says.
“Our research indicates that nine out of 10 attacks in the last year were on industrial organisations, and OT is the soft underbelly,” he explains. “Unfortunately, I get called every week by at least one organisation that’s been breached asking for help. The financial impact can run into the millions. And that’s the tip of the iceberg.”
A big part of the problem is the hybrid of digital and legacy technologies and equipment, where increased digitalisation increases the potential attack vector for a hostile state or organisation. Many organisations have rigorous IT cyber security measures, but it is not always the same for increasingly connected OT estates. Increasing connectivity of OT opens up potential doors to hackers.
“It’s no longer a case of installing equipment and operational technology (OT) and never upgrading it or touching it again. The major OEMs – Rockwell, ABB, Siemens, Honeywell – are providing connected equipment, sometimes including Edge computing and even additional resources in the cloud. These come with new mandates and requirements for warranty, patching and security.
“This trend towards increasingly digital industrial operations environments is going one way. It is evolving all the time.”
The benefits are clear. Getting digitalisation in industrial operations right means more operational time, improved efficiency, reduced costs, the ability to mitigate risk and tools for tackling huge global challenges.
“There’s huge benefit in end-to-end operational technology (OT) management: security is a big aspect, of course, but it’s not everything.
“What we find is that OT environments tend to be quite isolated, operating with limited shared standard procedures, or reliance on knowledge that’s been in the organisation for a long time and is at risk of being lost if people leave. ServiceNow can digitise that activity, which creates the ability to get information to engineers’ fingertips quickly.
“We can also help create common toolsets across different regions and different parts of the business. That helps increase machine uptime, avoid obsolescence, and drive transformation, as well as improving security.”
“Our research indicates that nine out of 10 attacks in the last year were on industrial organisations, and OT is the soft underbelly.”
Ben Barker, ServiceNow
Can you see what I see?
So where should utilities start when it comes to managing OT? It helps if they understand the technology they already have, says Barker. “You can’t secure what you can’t see. Typically, a data or cyber breach or ransomware demand is the result of not knowing all the devices in an industrial organisation’s footprint, and how they are connected. That means you don’t know the potential security impact – which could result in a service shutdown.
“We find most organisations don’t have a precise understanding of their OT environment, or it isn’t centralised and secured. But how can you manage what you don’t understand?”
By contrast, an organisation that is managing OT effectively is likely to have:
- Gained a very precise understanding of its industrial environment, including OT, industrial networks, and IT
- Created centralised digital information
- Minimised security risks
- Reduced potential attack vectors
Organisations that put off investments run the risk of being left behind or compromised. “An automated approach is crucial, particularly with large-scale national and international infrastructure: it’s a must-have for these types of set-ups and environments,” says Barker.
“If you look at the types of controls that are coming out, and the rigour that’s required, to do all of that manually is extremely difficult. Trying to manually meet new requirements may have the effect of creating more risk, not less.”
in association with
