Short article / NIST CSF 2.0

Office Network vs. Control Systems: Why OT Needs Different Protection

Harris Ejiofor, CISM – CyberShield Advisory

The computers that run pumps, valves and generators are not like office computers. Here is why operational technology needs its own security approach, explained for managers.

Most organizations have two kinds of computer systems. Information technology (IT) is the office side: email, billing, files and accounting. Operational technology (OT) is the side that runs physical equipment: the controllers, sensors and screens that open valves, start pumps, manage substations or keep a treatment process within limits. In a utility, an electric cooperative or a fuel distributor, OT is the business.

Both need protecting, but they cannot be protected the same way.

What makes OT different

Safety and service come first. In the office, the priority is usually keeping data private. In operations, the priority is keeping equipment safe and service running. A security step that stops a pump at the wrong moment can cause more harm than the threat it was meant to prevent.
Equipment lasts a long time. Controllers often run for many years, sometimes on older software that cannot be updated easily or at all. Replacing them may mean shutting down a process.
Changes need planning. You cannot simply restart an operations computer to install an update in the middle of the day. Updates are tested and scheduled, often in maintenance windows.
Normal security tools can disrupt it. Some scanning and monitoring that is routine in an office can upset sensitive equipment, so it has to be chosen and set up carefully.
Vendors are part of the picture. Equipment suppliers and integrators often need remote access to support their systems, which creates paths that must be controlled.

Where the two worlds meet

Problems usually start where IT and OT connect. Over the years, convenience creates links: a manager who wants plant readings on a desk computer, an engineer who checks screens from home, a vendor who installed remote support. Each link can carry an attack from the office side into operations. Ransomware that begins with an emailed link can end up affecting the systems that run your equipment if nothing stands in the way.

Practical first steps

Know what you have. List the operational devices, what they do, who supports them and how they connect.
Separate the networks. Put operations behind its own boundary, and allow only the connections you truly need, each one written down.
Control remote access. One managed path, a second sign-in step, named accounts, and vendor access switched on only when needed.
Plan for running by hand. Make sure operators can keep things safe if the control computers must be disconnected, and practise it.
Protect what cannot be patched. If a system cannot be updated, isolate it more tightly and watch it more closely.

Frameworks that help

The NIST Cybersecurity Framework (CSF) 2.0 gives leadership a common way to talk about security across both IT and OT through six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST also publishes a dedicated guide to OT security. For energy organizations, the Department of Energy's Cybersecurity Capability Maturity Model (C2M2) measures how mature these practices are and is designed with operations in mind.

Take the next step