Operational technology (OT) security: How to reduce cyber risk when IT and OT converge

Protect Your Industrial Network From Cyber Threats, Malicious Insiders and Human Error

Tenable One OT Exposure can help you identify threats and predictively prioritize cybersecurity risks and other security vulnerabilities to maximize the safety and reliability of your modern OT environment.

Tenable One OT Exposure delivers:

• Complete visibility into your converged attack surface
• A multi-detection engine that discovers high-risk events and activities that may impact your OT environment
• Visibility into your infrastructure from network down to individual device level
• Predictive Prioritization for every asset in your ICS network so you can find vulnerabilities and understand risk level
• Tracking for user-based changes or malware across your network or on a device

Industrial controllers are a focal point for attacks on industrial operations and critical infrastructure. So, how do you keep your ever-expanding attack surface safe?

Tenable One OT Exposure offers a comprehensive security solution for IT and OT security. It can help protect your industrial networks from threats, malicious insiders and other risks with capabilities such as:

• 360-degree visibility into converged IT/OT environments and industrial control systems (ICS) activity
• A multi-detection engine that discovers high-risk events and behaviors that threaten your organization
• Automated alerts for policy violations and detection of deviations from your network traffic baseline
• Signature updates that use crowd-sourced data to discover new attacks
• Passive detection and patented active querying to find threats to your network and OT devices
• Up-to-date and detailed inventory list with risk data to help you prioritize vulnerabilities and plan maintenance
• Configuration control with reports about changes to OT assets including programmable logic controllers (PLCs), distributed control systems (DCSs) and human-machine interfaces (HMIs).

In your OT environment, your OT devices are increasingly connected, thereby creating new challenges in securing your industrial network. Air-gaps alone are no longer effective because today's industrial attack surface now encompasses both IT and OT. This makes lateral attacks a growing threat. If attackers find a weak link on either side, they can use it as a gateway into your entire organization, quickly gaining access to both information and operations.

An integrated IT/OT security strategy can detect attacks earlier and help your team more effectively identify, investigate and address vulnerabilities and threats across your attack surface.

This white paper explores:

• How OT and IT are increasingly converging
• What’s happening in your expanding attack surface and attack vectors
• Issues contributing to a disconnect between IT and OT security practices
• Security and compliance best practices for industrial networks
• Benefits of a converged IT/OT security strategy

Operational technology plays an important role in critical infrastructure and industrial environments. In addition to routers, servers, computers and switches used in traditional IT environments, to operate plants and factories, industries also use OT devices such as distributed control systems (DCSs), programmable logic controllers (PLCs), and human-machine interfaces (HMIs).

While threats that begin in IT can laterally move into your OT environment, OT threats aren’t necessarily the same as IT security risks. Because of this, you need different security tools and operating policies to secure your OT environment.

This white paper explores:

• What’s fueling IT/OT convergence
• Why air-gapping OT systems is not effective
• What accidental convergence is and what can happen
• Threat actors looking to infiltrate your systems
• How you can plan ahead for OT security including more visibility, better situational analysis and reduction of cyber risk

Most ICS networks lack basic security controls and the ability to automatically manage assets like you’d find in more traditional IT environments.

Unfortunately, attackers know this and that’s why ICS networks are increasingly under attack.

As your organization looks for ways to defend your ICS systems, automated asset discovery and automated asset management are critical. If you don’t have an up-to-date and accurate ICS asset inventory, you can’t effectively manage OT risks. If you don’t know your risks, you can’t secure your environment.

As your ICS network grows and your IT and OT networks continue to evolve, effective asset management is an increasingly important component of your overall cybersecurity strategy.

This white paper explores:

• Incident response strategies
• How to decrease resolution time and ensure operational continuity
• Compliance with key industry regulations

Within your industrial control system environment, if you’re using network monitoring only, you may miss a device attack. Network monitoring only gives you about 50% visibility into your converged IT/OT environment and those blind spots put you at risk for being infected for days — or even months — without your knowledge.

Effective OT cybersecurity is more than network monitoring. By adding device-based security measures to your exposure management program, you’ll have better situational awareness about your actual cyber risks so you can plan remediation and defense strategies accordingly.

This white paper explores how to:

• Improve controller integrity by quickly discovering device changes made through physical connections
• Discover assets, even those that don’t communicate over your network
• Maintain “last known good state” data so you can enable holistic back-up and recovery strategies
• Monitor all routable components of your network

The Tenable Connect community is a place to share common interests in OT security and exchange ideas. Tenable Connect is a great resource to help you make the most of your Tenable products and access fresh ideas about how to keep your OT environment secure.

When it’s time to choose an OT cybersecurity solution, you want to know if you’re choosing one that meets all of your organization’s unique and specific requirements and if it’s flexible and scalable for future requirements you may have.

To reduce exposures in your OT environment, the solution you choose should support your specific OT devices, including non-disruptive asset discovery (even in older network assets), alerts on critical vulnerabilities, and support for secure OT/IT alignment.

Knowing the right questions to ask upfront can prevent future headaches and ensure you choose the best solution to secure your OT and IT environments. Here are six important questions to consider when evaluating OT security solutions:

1. Is it vendor-agnostic?

The solution should support all of your protocols and specific devices.

2. Does it provide multi-detection methods?

The solution should provide coverage both to the network and devices on the network.

3. Does it detect and alert on known common vulnerabilities and exposures?

A platform that incorporates known CVE discovery into your security policy will provide faster detection.

4. Does it provide IT support in addition to OT?

The solution should work in conjunction with your already-deployed IT security products such as your security information event management (SIEM) tool, next-generation firewalls (NGFWs) and diode-based firewalls.

5. Does it support secure IT/OT alignment?

Each environment needs purpose-made solutions.

6. Is it designed to live in an OT environment from a hardware or operating environment perspective?

Your solution should be configurable to meet your network and physical architecture requirements.

Take a deeper dive into these questions and how they can impact your buying decisions.

Whether intentional or accidental, there are several trends increasing attack vectors across OT environments. Here are some common OT trends and how they can impact your organization:

1. Purposeful convergence of IT/OT

By uniting IT and OT and eliminating siloed infrastructures, you may reduce costs and improve operational efficiencies.

2. Accidental convergence of IT/OT

If your organization doesn’t have a convergence strategy, but your employees use IT assets (such as laptops, thumb drives etc.) in OT environments, it can inadvertently create an accidental IT/OT convergence that increases organizational risks.

3. Industry 4.0

Industry 4.0 includes the introduction of IoT tech used to monitor and/or control OT environments and/or assets.

4. Increased collaboration

IT and OT teams are collaborating with each other more than ever before. Information and expertise silos are beginning to come down and, in some cases, IT and OT function on the same team.

Because today's cybercriminals can attack from all sides — and attacks laterally creep across IT to OT and vice versa — keep an eye on these trends to ensure comprehensive OT security.

Tenable One OT Exposure protects your industrial network from malicious insiders, cyber threats and human error. The solution provides deep situational awareness about all the threats that put your OT network at risk so you can maximize the visibility, security and control of your operational technology environment.

Building Resilient OT Environments: Safeguards for Electric Utilities

One in 10 cyberattacks around the world in 2022 targeted energy organizations, making it the fourth most-attacked industry. With this growing number of attacks on critical infrastructure, it's important to understand how attackers can take advantage of industrial control systems and the role vulnerability management best practice plays in reducing risk, mitigating damage and preventing the shutdown of essential services. 

Read more

How to Tackle OT Challenges: Asset Inventory and Vulnerability Assessment

With the convergence of IT and OT devices in industrial environments, comprehensive asset discovery and vulnerability identification and remediation is complex and challenging. In many environments, most OT systems are legacy, customized, or proprietary, which increases cyber threats and complicates mitigation. Responsive and accurate vulnerability detection requires active monitoring and querying of all of your OT devices. 

Read more

Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid

To uphold its national defense mission, the U.S. Department of Defense depends on critical infrastructure to manage everything from illuminating command centers to fueling advanced weapons systems. At the heart of this infrastructure are OT devices, including the hardware and software necessary to monitor and control physical processes and systems like the power grid. Unfortunately, the power grid is vulnerable to cyberattacks, and the consequences of an attack could be dire. 

Read more

Navigating Security Challenges Around OT in the DoD’s Manufacturing Lines

Operational technology has a direct impact on the Department of Defense's manufacturing lines and can play a vital role in improving supply chain management and logistics. As DoD (DoD) integrates OT devices into the Defense Industrial Base (DIB), it introduces new cyber risks and security challenges. Yet, ensuring OT system security is paramount to mobilization, deployment and the sustainability of military operations. 

Read more

How To Secure Your IT, OT and IoT Assets With an Exposure Management Platform

To stay ahead of today's evolving threat landscape, especially in converged IT/OT environments, your organization needs end-to-end visibility and the ability to prioritize risk across all of your assets — IT, OT and IoT. An exposure management platform like Tenable One enables comprehensive visibility that's critical to ensuring your teams can monitor, analyze and safeguard every component of your digital infrastructure effectively. 

Read more

The Need for Automated Asset Discovery

If you don’t know which assets exist within your OT environment, you can’t protect them. This video explores how Tenable One OT Exposure automated asset discovery tools will help you overcome challenges created by using a mix of manual processes for asset discovery and management. In two minutes, learn how Tenable One OT Exposure:

• Reduces manual labor, time and expense
• Improves your incident response and recovery processes
• Increases program accuracy and efficiencies
• Addresses compliance requirements
• Helps you implement a reliable and effective vulnerability management process

Watch video

The Importance of the industrial control plane

ICS networks employ two types of protocols: data plane protocols to manage physical parameters for ongoing processes and control plane protocols to manage engineering activities. In just two minutes, learn:

• Why your industrial control plane (ICP) is difficult to monitor
• How a lack of security controls impacts your industrial control plane
• What potential problems can arise when you don’t monitor your ICP
• How Tenable One OT Exposure can help

Watch video

Why Industrial Controllers are the Most Important Assets to Protect in ICS Networks

Controllers are the brains of your industrial network, but they are surprisingly vulnerable. That’s because they were designed decades ago with either few protections or none at all, creating OT security risks, which leave you vulnerable for attacks. In two minutes, learn:

• Why networks are often under-protected
• Who can make changes to logic
• Potentially catastrophic results of continuing operations and safety of malicious or erroneous changes
• How Tenable One OT Exposure can protect against unauthorized changes

Watch video

Proactive Security on Both Fronts for Industrial Control Environments

Is your OT security solution passive or active? Unless you’re listening to both your network and actively querying devices, you don’t have full protection. Detailed asset inventory and real-time information are critical components of protecting your converged IT/OT environment. In two minutes, learn:

• Why being passive and waiting for threats to appear on your network may be too late
• Where your blind spots may be
• How to safely and effectively gain a comprehensive view across your industrial environment

Watch video

Top Threats to Industrial Control Systems

Attacks on industrial control systems and critical infrastructure environments continue to increase. If your ICS or infrastructure is compromised, it can cause widespread damage and put lives at risk. Do you know the top threats to guard against? In two minutes, learn:

• Why ICS systems are more vulnerable to attacks today than ever before
• How you can become collateral damage even if your company is not the target
• What kind of threats may exist inside your network
• The top obstacles for securing your controllers

Watch video

In modern industrial and critical infrastructure environments, an increasing number of devices are now connected to your networks, many of which are internet-facing. This changing OT environment means traditional ways of protecting OT devices, like air-gapping or air walls, are no longer effective.

From malicious insiders and human errors, it’s increasingly challenging to effectively discover, investigate and remediate all the threats lurking against industrial and critical infrastructure environments. And because of that, OT attacks are on the rise.

Effective OT security requires complete visibility, security and control over all of the threats that put you at risk. Tenable One OT Exposure is the industry’s first unified, risk-based solution for converged IT/OT environments.

Get comprehensive visibility into your industrial environment. Actively query your OT devices in their native protocols and get a more complete understanding of your modern attack surface.