Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

IT/OT Convergence: Now Is the Time to Act

IT/OT Convergence: Now Is the Time to Act

Presidential advisory committee provides recommendations to improve critical infrastructure security.

Critical infrastructure in the U.S. faces a significantly heightened threat landscape. The importance of securing information technology (IT) and operational technology (OT) systems and their convergence has become a national security imperative. Successful OT attacks can impact human safety and damage physical equipment, taking offline for extended periods of time the critical processes that OT equipment supports.

Compromises of critical infrastructure IT, ICS and OT are happening with increasing frequency globally. Recent high-profile examples include:

  • Ukraine electric grid (2015, 2016)
  • Colonial Pipeline (2021)
  • Oldsmar, Florida water treatment plant (2021)

According to the Gartner® report “Predicts 2022: Cyber Physical Systems Security - Critical Infrastructure in Focus”, published in 11/17/21, “Attacks on organizations in critical infrastructure sectors have increased dramatically, from less than 10 in 2013 to almost 400 in 2020 – a 3,900% change.”

In light of this reality, the President’s National Security Telecommunications Advisory Committee (NSTAC) was tasked with developing a report to examine the key challenges of securing converged OT systems against threats that emerge from IT network connections and to identify emerging approaches to increase OT resiliency to these threats. I had the privilege of serving as the Chair for the NSTAC subcommittee that developed the report.

The NSTAC received more than 30 briefings from subject-matter experts, including government entities and policymakers; critical infrastructure owners and operators of converged IT/OT environments and original equipment manufacturers; and cloud service providers, integrators and cybersecurity vendors.

IT/OT cybersecurity has not been prioritized

The resulting report found that, as a nation, we have not yet prioritized securing these interconnected systems. This is despite the fact that IT/OT convergence is not new, and that we have the technology and knowledge to protect these systems.

Briefers noted that many organizations lack complete visibility into their OT environments, including IT/OT interconnections and supply chain dependencies. In addition, OT and IT personnel often operate in silos, negatively impacting coordination on security. And further exacerbating the challenge, requests for proposals and procurement vehicles for OT systems acquisitions in both the public and private sectors rarely include cybersecurity requirements.

Government has an opportunity to lead

The report includes 15 recommendations, which can help improve the security of converged IT/OT systems in both the public and private sectors. Among these, the report identified three recommendations, which can be implemented by President Biden to immediately improve the cybersecurity posture of OT systems that are owned and operated by the U.S. government, and to serve as a model for protecting privately owned critical infrastructure:

  • First, the Cybersecurity and Infrastructure Security Agency (CISA) should issue a Binding Operational Directive requiring executive civilian branch departments and agencies to maintain a real-time continuous inventory of all OT devices, software, systems and assets within their area of responsibility, including an understanding of any interconnectivity to other systems. Once federal agencies clearly understand the vast interconnected nature of their OT devices and infrastructure, they can then make risk-informed decisions about how to prioritize their IT, OT, and cybersecurity resources.
  • Second, CISA should develop guidance for procurement language for OT products and services and require the inclusion of risk-informed cybersecurity capabilities for products and services that support converged IT/OT environments, including for supply chain risk management. CISA should then work with the General Services Administration to require the inclusion of risk-informed cybersecurity capabilities in procurement vehicles for the federal government.
  • Finally, the National Security Council, CISA, and the Office of the National Cybersecurity Director should prioritize the development and implementation of interoperable, technology-neutral and vendor-agnostic information-sharing mechanisms to enable the real time sharing of sensitive collective-defense information between authorized stakeholders involved with securing the critical infrastructure of the U.S.

The cybersecurity threats to critical infrastructure are real. And yet, we are not helpless. We have the knowledge and capabilities necessary to materially improve our security posture. What we have lacked is the determination to put this knowledge and technology to use. It is time we started meeting IT/OT convergence with the sense of urgency it requires. Implementing the recommendations of the NSTAC report will help improve government and critical infrastructure IT/OT security, and will have significant positive downstream effects on the private sector.

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Tenable.io Web Application Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web Application Scanning trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.cs Cloud Security.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable.io Container Security

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try Tenable Lumin

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable.io Vulnerability Management, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable.cs

Enjoy full access to detect and fix cloud infrastructure misconfigurations and view runtime vulnerabilities. Sign up for your free trial now.

Your Tenable.cs Cloud Security trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.io Web Application Scanning.

Contact a Sales Rep to Buy Tenable.cs

Contact a Sales Representative to learn more about Tenable.cs Cloud Security and see how easy it is to onboard your cloud accounts and get visibility into both cloud misconfigurations and vulnerabilities within minutes.

Try Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Promotional pricing extended until December 31st.
Buy a multi-year license and save more.

Add Support and Training