Navigating the IT/OT Divide: A New Blog Series

Hey everyone, Joe Baxter here! For those who don't know me, I'm a security engineer who's had the unique opportunity to bridge both the Information Technology (IT) and Operational Technology (OT) worlds throughout my career. I've seen firsthand the incredible advancements and the equally incredible challenges that come with securing our digital and physical infrastructures.

It's always a problem when anyone views cybersecurity through a one-size-fits-all lens. While the core principles of protecting systems and data remain constant, the realities of IT and OT couldn't be more different. And frankly, applying IT security methodologies directly to OT environments can lead to more problems than solutions.

This isn't just about different devices; it's about fundamentally different priorities, technologies, and risks. In the IT world, we're often focused on the confidentiality and integrity of information – safeguarding proprietary data, personal identifiable information (PII), and ensuring business continuity through data availability. Timing, while important, isn't always absolutely critical.

But step into the OT realm, and the landscape shifts dramatically. Here, the priority isn't just about data. It's about personal safety, environmental protection, and the continuous operation of physical processes. Think about a power plant, a manufacturing line, or a water treatment facility. A single missed setpoint, a delayed command, or an integrity issue with control data can have immediate and severe consequences, impacting human lives, the environment, and the very function of critical infrastructure. Data in OT is often temporal and ephemeral, valuable at the millisecond another device acts upon it, not necessarily for its long-term exfiltration. The risk centers on its availability and integrity in real-time.

This fundamental difference in priorities dictates vastly different approaches to security. Zero Trust in OT, for example, isn't just about limiting who can access what data. It's about ensuring that only the correct and individual devices may communicate, that they may communicate the correct data, and that no external device or actor may interfere with that data.

Over the coming weeks, I'm excited to launch a new blog series where we'll dive deep into these differentiating factors between IT and OT cybersecurity. We'll explore:

• Priorities: Why availability and integrity often trump confidentiality in OT, and how personal safety takes paramount importance.
• Data Characteristics: The ephemeral nature of OT data versus the long-term value of IT data.
• Network Protocols: The unique challenges of securing non-routable OT protocols and older serial communications, a stark contrast to the almost exclusive TCP/IP world of IT. We'll even touch on the historical headaches of MTU sizes for older equipment!
• System Lifecycles: The often decades-long lifespan of OT equipment compared to the much shorter refresh cycles in IT.
• Threat Models: How the motivations and methods of adversaries targeting OT differ from those focused on IT.
• And much more!

I intend to shed light on these critical distinctions, helping bridge the understanding gap between IT and OT professionals, and ultimately, contributing to more effective and appropriate cybersecurity strategies for our vital operational environments.

Stay tuned for the first post in the series, where we'll kick things off by exploring the contrasting priorities of IT and OT. It's going to be an insightful journey, and I look forward to sharing my experiences and perspectives with all of you.

See you in the next post!